chore(deps-dev): bump pm-ops from 2026.8.17 to 2026.8.31

[dependabot]

Bumps pm-ops from 2026.8.17 to 2026.8.31.

Release notes

Sourced from pm-ops's releases.

pm-ops v2026.08.31

Fixed

• The release changelog remained Unreleased after the release tag was created (ops-3ete)

pm-ops v2026.08.29

Fixed

• Harden literal scalar assignment parsing (ops-mjnd)
• Escaped shell metacharacter in scalar value bypasses the attestation gate (ops-5mv7)
• Shell scalar assignments were read from raw text, so a comment could make an unattested publish pass the attestation gate (ops-q6wi)
• A multi-line fixture joined with a literal backslash-n made the array-flag case pass without exercising it (ops-xmb6)

pm-ops v2026.08.28

Fixed

• Escaping a markdown cell's pipes without its backslashes shifts every column after it (ops-pzjp)
• The publish-attestation scan judged shell text with a regular expression, so real unattested publishes scanned clean (ops-jhc8)
• Prevent a failed provenance publish from silently falling back to an unattested publish (ops-w3ke)
• The changelog gate stamps an untagged version with the current date, so its verdict flips every midnight with no commit (ops-vll0)
• Canonicalize fleet metric reads and enforce the pm 2026.8.20 host contract (ops-3w9m)

Security

• The identity gate deadlocks the one remediation its own failure message prescribes (ops-wsi9)

Changelog

Sourced from pm-ops's changelog.

2026.8.31 - 2026-08-31

Fixed

• Finish shell-accurate heredoc and unset handling in publish attestation (ops-62d1)
• The release changelog remained Unreleased after the release tag was created (ops-3ete)

Security

• A heredoc body and a discarded binding both let an unattested publish pass the attestation gate (ops-5jp6)

2026.8.29 - 2026-08-29

Fixed

• Harden literal scalar assignment parsing (ops-mjnd)
• Escaped shell metacharacter in scalar value bypasses the attestation gate (ops-5mv7)
• Shell scalar assignments were read from raw text, so a comment could make an unattested publish pass the attestation gate (ops-q6wi)
• A multi-line fixture joined with a literal backslash-n made the array-flag case pass without exercising it (ops-xmb6)

2026.8.28 - 2026-08-28

Fixed

• Escaping a markdown cell's pipes without its backslashes shifts every column after it (ops-pzjp)
• The publish-attestation scan judged shell text with a regular expression, so real unattested publishes scanned clean (ops-jhc8)
• Prevent a failed provenance publish from silently falling back to an unattested publish (ops-w3ke)
• The changelog gate stamps an untagged version with the current date, so its verdict flips every midnight with no commit (ops-vll0)
• Canonicalize fleet metric reads and enforce the pm 2026.8.20 host contract (ops-3w9m)

Security

• The identity gate deadlocks the one remediation its own failure message prescribes (ops-wsi9)

Commits

• fac7d5e Release pm-ops v2026.08.31
• 6de8973 chore(deps-dev): bump @​types/node from 26.2.0 to 26.4.0 (#72)
• ee59e71 Regenerate the changelog so the committed file matches the release tag (#75)
• d9225fa Release pm-ops v2026.08.29
• 2d84340 fix(changelog): state the raw-text scalar defect as a gate that failed open (...
• 43c647b Make the attestation gate measure what it claims: literal-assignment scalars ...
• a7dd13e Refuse to publish without provenance, and gate every publish path against reg...
• 5b6fbe7 Release pm-ops v2026.08.28
• c7da4bf Merge pull request #63 from unbraind/ci/publish-by-oidc-trusted-publishing
• 3669925 fix: split on unspaced shell separators, and stop two guards at the right bou...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for pm-ops since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Bumps the dev dependency pm-ops from 2026.8.17 to 2026.8.31. The release fixes attestation gate bypasses, provenance fallback, changelog stamping, and markdown escaping.

• The peer dependency requirement for @unbrained/pm-cli is now >=2026.8.20, so environments must upgrade the CLI before adopting this version.

^{Written for commit 48d47eb. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[dependabot]

Bumps pm-ops from 2026.8.17 to 2026.8.31.

Release notes

Sourced from pm-ops's releases.

pm-ops v2026.08.31

Fixed

• The release changelog remained Unreleased after the release tag was created (ops-3ete)

pm-ops v2026.08.29

Fixed

• Harden literal scalar assignment parsing (ops-mjnd)
• Escaped shell metacharacter in scalar value bypasses the attestation gate (ops-5mv7)
• Shell scalar assignments were read from raw text, so a comment could make an unattested publish pass the attestation gate (ops-q6wi)
• A multi-line fixture joined with a literal backslash-n made the array-flag case pass without exercising it (ops-xmb6)

pm-ops v2026.08.28

Fixed

• Escaping a markdown cell's pipes without its backslashes shifts every column after it (ops-pzjp)
• The publish-attestation scan judged shell text with a regular expression, so real unattested publishes scanned clean (ops-jhc8)
• Prevent a failed provenance publish from silently falling back to an unattested publish (ops-w3ke)
• The changelog gate stamps an untagged version with the current date, so its verdict flips every midnight with no commit (ops-vll0)
• Canonicalize fleet metric reads and enforce the pm 2026.8.20 host contract (ops-3w9m)

Security

• The identity gate deadlocks the one remediation its own failure message prescribes (ops-wsi9)

Changelog

Sourced from pm-ops's changelog.

2026.8.31 - 2026-08-31

Fixed

• Finish shell-accurate heredoc and unset handling in publish attestation (ops-62d1)
• The release changelog remained Unreleased after the release tag was created (ops-3ete)

Security

• A heredoc body and a discarded binding both let an unattested publish pass the attestation gate (ops-5jp6)

2026.8.29 - 2026-08-29

Fixed

• Harden literal scalar assignment parsing (ops-mjnd)
• Escaped shell metacharacter in scalar value bypasses the attestation gate (ops-5mv7)
• Shell scalar assignments were read from raw text, so a comment could make an unattested publish pass the attestation gate (ops-q6wi)
• A multi-line fixture joined with a literal backslash-n made the array-flag case pass without exercising it (ops-xmb6)

2026.8.28 - 2026-08-28

Fixed

• Escaping a markdown cell's pipes without its backslashes shifts every column after it (ops-pzjp)
• The publish-attestation scan judged shell text with a regular expression, so real unattested publishes scanned clean (ops-jhc8)
• Prevent a failed provenance publish from silently falling back to an unattested publish (ops-w3ke)
• The changelog gate stamps an untagged version with the current date, so its verdict flips every midnight with no commit (ops-vll0)
• Canonicalize fleet metric reads and enforce the pm 2026.8.20 host contract (ops-3w9m)

Security

• The identity gate deadlocks the one remediation its own failure message prescribes (ops-wsi9)

Commits

• fac7d5e Release pm-ops v2026.08.31
• 6de8973 chore(deps-dev): bump @​types/node from 26.2.0 to 26.4.0 (#72)
• ee59e71 Regenerate the changelog so the committed file matches the release tag (#75)
• d9225fa Release pm-ops v2026.08.29
• 2d84340 fix(changelog): state the raw-text scalar defect as a gate that failed open (...
• 43c647b Make the attestation gate measure what it claims: literal-assignment scalars ...
• a7dd13e Refuse to publish without provenance, and gate every publish path against reg...
• 5b6fbe7 Release pm-ops v2026.08.28
• c7da4bf Merge pull request #63 from unbraind/ci/publish-by-oidc-trusted-publishing
• 3669925 fix: split on unspaced shell separators, and stop two guards at the right bou...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for pm-ops since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Bumps the dev dependency pm-ops from 2026.8.17 to 2026.8.31. The release fixes attestation gate bypasses, provenance fallback, changelog stamping, and markdown escaping.

• The peer dependency requirement for @unbrained/pm-cli is now >=2026.8.20, so environments must upgrade the CLI before adopting this version.

^{Written for commit 48d47eb. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[dependabot]

Bumps pm-ops from 2026.8.17 to 2026.8.31.

Release notes

Sourced from pm-ops's releases.

pm-ops v2026.08.31

Fixed

• The release changelog remained Unreleased after the release tag was created (ops-3ete)

pm-ops v2026.08.29

Fixed

• Harden literal scalar assignment parsing (ops-mjnd)
• Escaped shell metacharacter in scalar value bypasses the attestation gate (ops-5mv7)
• Shell scalar assignments were read from raw text, so a comment could make an unattested publish pass the attestation gate (ops-q6wi)
• A multi-line fixture joined with a literal backslash-n made the array-flag case pass without exercising it (ops-xmb6)

pm-ops v2026.08.28

Fixed

• Escaping a markdown cell's pipes without its backslashes shifts every column after it (ops-pzjp)
• The publish-attestation scan judged shell text with a regular expression, so real unattested publishes scanned clean (ops-jhc8)
• Prevent a failed provenance publish from silently falling back to an unattested publish (ops-w3ke)
• The changelog gate stamps an untagged version with the current date, so its verdict flips every midnight with no commit (ops-vll0)
• Canonicalize fleet metric reads and enforce the pm 2026.8.20 host contract (ops-3w9m)

Security

• The identity gate deadlocks the one remediation its own failure message prescribes (ops-wsi9)

Changelog

Sourced from pm-ops's changelog.

2026.8.31 - 2026-08-31

Fixed

• Finish shell-accurate heredoc and unset handling in publish attestation (ops-62d1)
• The release changelog remained Unreleased after the release tag was created (ops-3ete)

Security

• A heredoc body and a discarded binding both let an unattested publish pass the attestation gate (ops-5jp6)

2026.8.29 - 2026-08-29

Fixed

• Harden literal scalar assignment parsing (ops-mjnd)
• Escaped shell metacharacter in scalar value bypasses the attestation gate (ops-5mv7)
• Shell scalar assignments were read from raw text, so a comment could make an unattested publish pass the attestation gate (ops-q6wi)
• A multi-line fixture joined with a literal backslash-n made the array-flag case pass without exercising it (ops-xmb6)

2026.8.28 - 2026-08-28

Fixed

• Escaping a markdown cell's pipes without its backslashes shifts every column after it (ops-pzjp)
• The publish-attestation scan judged shell text with a regular expression, so real unattested publishes scanned clean (ops-jhc8)
• Prevent a failed provenance publish from silently falling back to an unattested publish (ops-w3ke)
• The changelog gate stamps an untagged version with the current date, so its verdict flips every midnight with no commit (ops-vll0)
• Canonicalize fleet metric reads and enforce the pm 2026.8.20 host contract (ops-3w9m)

Security

• The identity gate deadlocks the one remediation its own failure message prescribes (ops-wsi9)

Commits

• fac7d5e Release pm-ops v2026.08.31
• 6de8973 chore(deps-dev): bump @​types/node from 26.2.0 to 26.4.0 (#72)
• ee59e71 Regenerate the changelog so the committed file matches the release tag (#75)
• d9225fa Release pm-ops v2026.08.29
• 2d84340 fix(changelog): state the raw-text scalar defect as a gate that failed open (...
• 43c647b Make the attestation gate measure what it claims: literal-assignment scalars ...
• a7dd13e Refuse to publish without provenance, and gate every publish path against reg...
• 5b6fbe7 Release pm-ops v2026.08.28
• c7da4bf Merge pull request #63 from unbraind/ci/publish-by-oidc-trusted-publishing
• 3669925 fix: split on unspaced shell separators, and stop two guards at the right bou...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for pm-ops since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Bumps the dev dependency pm-ops from 2026.8.17 to 2026.8.31. The release fixes attestation gate bypasses, provenance fallback, changelog stamping, and markdown escaping.

• The peer dependency requirement for @unbrained/pm-cli is now >=2026.8.20, so environments must upgrade the CLI before adopting this version.

^{Written for commit 48d47eb. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[dependabot]

Bumps pm-ops from 2026.8.17 to 2026.8.31.

Release notes

Sourced from pm-ops's releases.

pm-ops v2026.08.31

Fixed

• The release changelog remained Unreleased after the release tag was created (ops-3ete)

pm-ops v2026.08.29

Fixed

• Harden literal scalar assignment parsing (ops-mjnd)
• Escaped shell metacharacter in scalar value bypasses the attestation gate (ops-5mv7)
• Shell scalar assignments were read from raw text, so a comment could make an unattested publish pass the attestation gate (ops-q6wi)
• A multi-line fixture joined with a literal backslash-n made the array-flag case pass without exercising it (ops-xmb6)

pm-ops v2026.08.28

Fixed

• Escaping a markdown cell's pipes without its backslashes shifts every column after it (ops-pzjp)
• The publish-attestation scan judged shell text with a regular expression, so real unattested publishes scanned clean (ops-jhc8)
• Prevent a failed provenance publish from silently falling back to an unattested publish (ops-w3ke)
• The changelog gate stamps an untagged version with the current date, so its verdict flips every midnight with no commit (ops-vll0)
• Canonicalize fleet metric reads and enforce the pm 2026.8.20 host contract (ops-3w9m)

Security

• The identity gate deadlocks the one remediation its own failure message prescribes (ops-wsi9)

Changelog

Sourced from pm-ops's changelog.

2026.8.31 - 2026-08-31

Fixed

• Finish shell-accurate heredoc and unset handling in publish attestation (ops-62d1)
• The release changelog remained Unreleased after the release tag was created (ops-3ete)

Security

• A heredoc body and a discarded binding both let an unattested publish pass the attestation gate (ops-5jp6)

2026.8.29 - 2026-08-29

Fixed

• Harden literal scalar assignment parsing (ops-mjnd)
• Escaped shell metacharacter in scalar value bypasses the attestation gate (ops-5mv7)
• Shell scalar assignments were read from raw text, so a comment could make an unattested publish pass the attestation gate (ops-q6wi)
• A multi-line fixture joined with a literal backslash-n made the array-flag case pass without exercising it (ops-xmb6)

2026.8.28 - 2026-08-28

Fixed

• Escaping a markdown cell's pipes without its backslashes shifts every column after it (ops-pzjp)
• The publish-attestation scan judged shell text with a regular expression, so real unattested publishes scanned clean (ops-jhc8)
• Prevent a failed provenance publish from silently falling back to an unattested publish (ops-w3ke)
• The changelog gate stamps an untagged version with the current date, so its verdict flips every midnight with no commit (ops-vll0)
• Canonicalize fleet metric reads and enforce the pm 2026.8.20 host contract (ops-3w9m)

Security

• The identity gate deadlocks the one remediation its own failure message prescribes (ops-wsi9)

Commits

• fac7d5e Release pm-ops v2026.08.31
• 6de8973 chore(deps-dev): bump @​types/node from 26.2.0 to 26.4.0 (#72)
• ee59e71 Regenerate the changelog so the committed file matches the release tag (#75)
• d9225fa Release pm-ops v2026.08.29
• 2d84340 fix(changelog): state the raw-text scalar defect as a gate that failed open (...
• 43c647b Make the attestation gate measure what it claims: literal-assignment scalars ...
• a7dd13e Refuse to publish without provenance, and gate every publish path against reg...
• 5b6fbe7 Release pm-ops v2026.08.28
• c7da4bf Merge pull request #63 from unbraind/ci/publish-by-oidc-trusted-publishing
• 3669925 fix: split on unspaced shell separators, and stop two guards at the right bou...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for pm-ops since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Bumps the dev dependency pm-ops from 2026.8.17 to 2026.8.31. The release fixes attestation gate bypasses, provenance fallback, changelog stamping, and markdown escaping.

• The peer dependency requirement for @unbrained/pm-cli is now >=2026.8.20, so environments must upgrade the CLI before adopting this version.

^{Written for commit 48d47eb. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[dependabot]

Bumps pm-ops from 2026.8.17 to 2026.8.31.

Release notes

Sourced from pm-ops's releases.

pm-ops v2026.08.31

Fixed

• The release changelog remained Unreleased after the release tag was created (ops-3ete)

pm-ops v2026.08.29

Fixed

• Harden literal scalar assignment parsing (ops-mjnd)
• Escaped shell metacharacter in scalar value bypasses the attestation gate (ops-5mv7)
• Shell scalar assignments were read from raw text, so a comment could make an unattested publish pass the attestation gate (ops-q6wi)
• A multi-line fixture joined with a literal backslash-n made the array-flag case pass without exercising it (ops-xmb6)

pm-ops v2026.08.28

Fixed

• Escaping a markdown cell's pipes without its backslashes shifts every column after it (ops-pzjp)
• The publish-attestation scan judged shell text with a regular expression, so real unattested publishes scanned clean (ops-jhc8)
• Prevent a failed provenance publish from silently falling back to an unattested publish (ops-w3ke)
• The changelog gate stamps an untagged version with the current date, so its verdict flips every midnight with no commit (ops-vll0)
• Canonicalize fleet metric reads and enforce the pm 2026.8.20 host contract (ops-3w9m)

Security

• The identity gate deadlocks the one remediation its own failure message prescribes (ops-wsi9)

Changelog

Sourced from pm-ops's changelog.

2026.8.31 - 2026-08-31

Fixed

• Finish shell-accurate heredoc and unset handling in publish attestation (ops-62d1)
• The release changelog remained Unreleased after the release tag was created (ops-3ete)

Security

• A heredoc body and a discarded binding both let an unattested publish pass the attestation gate (ops-5jp6)

2026.8.29 - 2026-08-29

Fixed

• Harden literal scalar assignment parsing (ops-mjnd)
• Escaped shell metacharacter in scalar value bypasses the attestation gate (ops-5mv7)
• Shell scalar assignments were read from raw text, so a comment could make an unattested publish pass the attestation gate (ops-q6wi)
• A multi-line fixture joined with a literal backslash-n made the array-flag case pass without exercising it (ops-xmb6)

2026.8.28 - 2026-08-28

Fixed

• Escaping a markdown cell's pipes without its backslashes shifts every column after it (ops-pzjp)
• The publish-attestation scan judged shell text with a regular expression, so real unattested publishes scanned clean (ops-jhc8)
• Prevent a failed provenance publish from silently falling back to an unattested publish (ops-w3ke)
• The changelog gate stamps an untagged version with the current date, so its verdict flips every midnight with no commit (ops-vll0)
• Canonicalize fleet metric reads and enforce the pm 2026.8.20 host contract (ops-3w9m)

Security

• The identity gate deadlocks the one remediation its own failure message prescribes (ops-wsi9)

Commits

• fac7d5e Release pm-ops v2026.08.31
• 6de8973 chore(deps-dev): bump @​types/node from 26.2.0 to 26.4.0 (#72)
• ee59e71 Regenerate the changelog so the committed file matches the release tag (#75)
• d9225fa Release pm-ops v2026.08.29
• 2d84340 fix(changelog): state the raw-text scalar defect as a gate that failed open (...
• 43c647b Make the attestation gate measure what it claims: literal-assignment scalars ...
• a7dd13e Refuse to publish without provenance, and gate every publish path against reg...
• 5b6fbe7 Release pm-ops v2026.08.28
• c7da4bf Merge pull request #63 from unbraind/ci/publish-by-oidc-trusted-publishing
• 3669925 fix: split on unspaced shell separators, and stop two guards at the right bou...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for pm-ops since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Bumps the dev dependency pm-ops from 2026.8.17 to 2026.8.31. The release fixes attestation gate bypasses, provenance fallback, changelog stamping, and markdown escaping.

• The peer dependency requirement for @unbrained/pm-cli is now >=2026.8.20, so environments must upgrade the CLI before adopting this version.

^{Written for commit 48d47eb. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[dependabot]

Bumps pm-ops from 2026.8.17 to 2026.8.31.

Release notes

Sourced from pm-ops's releases.

pm-ops v2026.08.31

Fixed

• The release changelog remained Unreleased after the release tag was created (ops-3ete)

pm-ops v2026.08.29

Fixed

• Harden literal scalar assignment parsing (ops-mjnd)
• Escaped shell metacharacter in scalar value bypasses the attestation gate (ops-5mv7)
• Shell scalar assignments were read from raw text, so a comment could make an unattested publish pass the attestation gate (ops-q6wi)
• A multi-line fixture joined with a literal backslash-n made the array-flag case pass without exercising it (ops-xmb6)

pm-ops v2026.08.28

Fixed

• Escaping a markdown cell's pipes without its backslashes shifts every column after it (ops-pzjp)
• The publish-attestation scan judged shell text with a regular expression, so real unattested publishes scanned clean (ops-jhc8)
• Prevent a failed provenance publish from silently falling back to an unattested publish (ops-w3ke)
• The changelog gate stamps an untagged version with the current date, so its verdict flips every midnight with no commit (ops-vll0)
• Canonicalize fleet metric reads and enforce the pm 2026.8.20 host contract (ops-3w9m)

Security

• The identity gate deadlocks the one remediation its own failure message prescribes (ops-wsi9)

Changelog

Sourced from pm-ops's changelog.

2026.8.31 - 2026-08-31

Fixed

• Finish shell-accurate heredoc and unset handling in publish attestation (ops-62d1)
• The release changelog remained Unreleased after the release tag was created (ops-3ete)

Security

• A heredoc body and a discarded binding both let an unattested publish pass the attestation gate (ops-5jp6)

2026.8.29 - 2026-08-29

Fixed

• Harden literal scalar assignment parsing (ops-mjnd)
• Escaped shell metacharacter in scalar value bypasses the attestation gate (ops-5mv7)
• Shell scalar assignments were read from raw text, so a comment could make an unattested publish pass the attestation gate (ops-q6wi)
• A multi-line fixture joined with a literal backslash-n made the array-flag case pass without exercising it (ops-xmb6)

2026.8.28 - 2026-08-28

Fixed

• Escaping a markdown cell's pipes without its backslashes shifts every column after it (ops-pzjp)
• The publish-attestation scan judged shell text with a regular expression, so real unattested publishes scanned clean (ops-jhc8)
• Prevent a failed provenance publish from silently falling back to an unattested publish (ops-w3ke)
• The changelog gate stamps an untagged version with the current date, so its verdict flips every midnight with no commit (ops-vll0)
• Canonicalize fleet metric reads and enforce the pm 2026.8.20 host contract (ops-3w9m)

Security

• The identity gate deadlocks the one remediation its own failure message prescribes (ops-wsi9)

Commits

• fac7d5e Release pm-ops v2026.08.31
• 6de8973 chore(deps-dev): bump @​types/node from 26.2.0 to 26.4.0 (#72)
• ee59e71 Regenerate the changelog so the committed file matches the release tag (#75)
• d9225fa Release pm-ops v2026.08.29
• 2d84340 fix(changelog): state the raw-text scalar defect as a gate that failed open (...
• 43c647b Make the attestation gate measure what it claims: literal-assignment scalars ...
• a7dd13e Refuse to publish without provenance, and gate every publish path against reg...
• 5b6fbe7 Release pm-ops v2026.08.28
• c7da4bf Merge pull request #63 from unbraind/ci/publish-by-oidc-trusted-publishing
• 3669925 fix: split on unspaced shell separators, and stop two guards at the right bou...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for pm-ops since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Bumps the dev dependency pm-ops from 2026.8.17 to 2026.8.31. The release fixes attestation gate bypasses, provenance fallback, changelog stamping, and markdown escaping.

• The peer dependency requirement for @unbrained/pm-cli is now >=2026.8.20, so environments must upgrade the CLI before adopting this version.

^{Written for commit 48d47eb. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[dependabot]

Bumps pm-ops from 2026.8.17 to 2026.8.31.

Release notes

Sourced from pm-ops's releases.

pm-ops v2026.08.31

Fixed

• The release changelog remained Unreleased after the release tag was created (ops-3ete)

pm-ops v2026.08.29

Fixed

• Harden literal scalar assignment parsing (ops-mjnd)
• Escaped shell metacharacter in scalar value bypasses the attestation gate (ops-5mv7)
• Shell scalar assignments were read from raw text, so a comment could make an unattested publish pass the attestation gate (ops-q6wi)
• A multi-line fixture joined with a literal backslash-n made the array-flag case pass without exercising it (ops-xmb6)

pm-ops v2026.08.28

Fixed

• Escaping a markdown cell's pipes without its backslashes shifts every column after it (ops-pzjp)
• The publish-attestation scan judged shell text with a regular expression, so real unattested publishes scanned clean (ops-jhc8)
• Prevent a failed provenance publish from silently falling back to an unattested publish (ops-w3ke)
• The changelog gate stamps an untagged version with the current date, so its verdict flips every midnight with no commit (ops-vll0)
• Canonicalize fleet metric reads and enforce the pm 2026.8.20 host contract (ops-3w9m)

Security

• The identity gate deadlocks the one remediation its own failure message prescribes (ops-wsi9)

Changelog

Sourced from pm-ops's changelog.

2026.8.31 - 2026-08-31

Fixed

• Finish shell-accurate heredoc and unset handling in publish attestation (ops-62d1)
• The release changelog remained Unreleased after the release tag was created (ops-3ete)

Security

• A heredoc body and a discarded binding both let an unattested publish pass the attestation gate (ops-5jp6)

2026.8.29 - 2026-08-29

Fixed

• Harden literal scalar assignment parsing (ops-mjnd)
• Escaped shell metacharacter in scalar value bypasses the attestation gate (ops-5mv7)
• Shell scalar assignments were read from raw text, so a comment could make an unattested publish pass the attestation gate (ops-q6wi)
• A multi-line fixture joined with a literal backslash-n made the array-flag case pass without exercising it (ops-xmb6)

2026.8.28 - 2026-08-28

Fixed

• Escaping a markdown cell's pipes without its backslashes shifts every column after it (ops-pzjp)
• The publish-attestation scan judged shell text with a regular expression, so real unattested publishes scanned clean (ops-jhc8)
• Prevent a failed provenance publish from silently falling back to an unattested publish (ops-w3ke)
• The changelog gate stamps an untagged version with the current date, so its verdict flips every midnight with no commit (ops-vll0)
• Canonicalize fleet metric reads and enforce the pm 2026.8.20 host contract (ops-3w9m)

Security

• The identity gate deadlocks the one remediation its own failure message prescribes (ops-wsi9)

Commits

• fac7d5e Release pm-ops v2026.08.31
• 6de8973 chore(deps-dev): bump @​types/node from 26.2.0 to 26.4.0 (#72)
• ee59e71 Regenerate the changelog so the committed file matches the release tag (#75)
• d9225fa Release pm-ops v2026.08.29
• 2d84340 fix(changelog): state the raw-text scalar defect as a gate that failed open (...
• 43c647b Make the attestation gate measure what it claims: literal-assignment scalars ...
• a7dd13e Refuse to publish without provenance, and gate every publish path against reg...
• 5b6fbe7 Release pm-ops v2026.08.28
• c7da4bf Merge pull request #63 from unbraind/ci/publish-by-oidc-trusted-publishing
• 3669925 fix: split on unspaced shell separators, and stop two guards at the right bou...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for pm-ops since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Bumps the dev dependency pm-ops from 2026.8.17 to 2026.8.31. The release fixes attestation gate bypasses, provenance fallback, changelog stamping, and markdown escaping.

• The peer dependency requirement for @unbrained/pm-cli is now >=2026.8.20, so environments must upgrade the CLI before adopting this version.

^{Written for commit 48d47eb. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[dependabot]

Bumps pm-ops from 2026.8.17 to 2026.8.31.

Release notes

Sourced from pm-ops's releases.

pm-ops v2026.08.31

Fixed

• The release changelog remained Unreleased after the release tag was created (ops-3ete)

pm-ops v2026.08.29

Fixed

• Harden literal scalar assignment parsing (ops-mjnd)
• Escaped shell metacharacter in scalar value bypasses the attestation gate (ops-5mv7)
• Shell scalar assignments were read from raw text, so a comment could make an unattested publish pass the attestation gate (ops-q6wi)
• A multi-line fixture joined with a literal backslash-n made the array-flag case pass without exercising it (ops-xmb6)

pm-ops v2026.08.28

Fixed

• Escaping a markdown cell's pipes without its backslashes shifts every column after it (ops-pzjp)
• The publish-attestation scan judged shell text with a regular expression, so real unattested publishes scanned clean (ops-jhc8)
• Prevent a failed provenance publish from silently falling back to an unattested publish (ops-w3ke)
• The changelog gate stamps an untagged version with the current date, so its verdict flips every midnight with no commit (ops-vll0)
• Canonicalize fleet metric reads and enforce the pm 2026.8.20 host contract (ops-3w9m)

Security

• The identity gate deadlocks the one remediation its own failure message prescribes (ops-wsi9)

Changelog

Sourced from pm-ops's changelog.

2026.8.31 - 2026-08-31

Fixed

• Finish shell-accurate heredoc and unset handling in publish attestation (ops-62d1)
• The release changelog remained Unreleased after the release tag was created (ops-3ete)

Security

• A heredoc body and a discarded binding both let an unattested publish pass the attestation gate (ops-5jp6)

2026.8.29 - 2026-08-29

Fixed

• Harden literal scalar assignment parsing (ops-mjnd)
• Escaped shell metacharacter in scalar value bypasses the attestation gate (ops-5mv7)
• Shell scalar assignments were read from raw text, so a comment could make an unattested publish pass the attestation gate (ops-q6wi)
• A multi-line fixture joined with a literal backslash-n made the array-flag case pass without exercising it (ops-xmb6)

2026.8.28 - 2026-08-28

Fixed

• Escaping a markdown cell's pipes without its backslashes shifts every column after it (ops-pzjp)
• The publish-attestation scan judged shell text with a regular expression, so real unattested publishes scanned clean (ops-jhc8)
• Prevent a failed provenance publish from silently falling back to an unattested publish (ops-w3ke)
• The changelog gate stamps an untagged version with the current date, so its verdict flips every midnight with no commit (ops-vll0)
• Canonicalize fleet metric reads and enforce the pm 2026.8.20 host contract (ops-3w9m)

Security

• The identity gate deadlocks the one remediation its own failure message prescribes (ops-wsi9)

Commits

• fac7d5e Release pm-ops v2026.08.31
• 6de8973 chore(deps-dev): bump @​types/node from 26.2.0 to 26.4.0 (#72)
• ee59e71 Regenerate the changelog so the committed file matches the release tag (#75)
• d9225fa Release pm-ops v2026.08.29
• 2d84340 fix(changelog): state the raw-text scalar defect as a gate that failed open (...
• 43c647b Make the attestation gate measure what it claims: literal-assignment scalars ...
• a7dd13e Refuse to publish without provenance, and gate every publish path against reg...
• 5b6fbe7 Release pm-ops v2026.08.28
• c7da4bf Merge pull request #63 from unbraind/ci/publish-by-oidc-trusted-publishing
• 3669925 fix: split on unspaced shell separators, and stop two guards at the right bou...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for pm-ops since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Bumps the dev dependency pm-ops from 2026.8.17 to 2026.8.31. The release fixes attestation gate bypasses, provenance fallback, changelog stamping, and markdown escaping.

• The peer dependency requirement for @unbrained/pm-cli is now >=2026.8.20, so environments must upgrade the CLI before adopting this version.

^{Written for commit 48d47eb. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.