Security
- Scorecard alert 29: patch new brace-expansion recursion and rewrite denial-of-service advisories Eintrag pm-cbzvgn
Fixed
- Registry install acceptance loses subprocess timeout and signal evidence and labels every failure as registry availability Eintrag pm-q7c36n
- Bun merge-driver installation disagrees with strict health Eintrag pm-vks66s
- Expose host-bound audited workspace settings mutation to extension commands Eintrag pm-wtqltn
- Full-item stdin JSON update silently ignores edited notes Eintrag pm-2589e6
Fixed
- GH-1340: pm duplicates treats UTF-8 prose as a 0.99 issue-code match Eintrag pm-1ieq24
- Persist revised linked evidence notes while preserving idempotent retries Eintrag pm-zqxlfs
- Bound Plan mutation receipts while preserving full inspection Eintrag pm-hqy7lr
Deprecated
- Alias-usage counters: measure deprecated-spelling hits so grammar-freeze removals are evidence-based Eintrag pm-0mox
- Extension activation attributes canonical full-list projection to deprecated --full Eintrag pm-8uwigr
Other
- Replay each history state once: reuse the previous entry's digest as the next before-hash, stop at the first matching hash epoch, and drop the second document clone Eintrag pm-hen0t6
Fixed
- GH-1325: history diff cursor drops newest rows and strands the final page Eintrag pm-c3aiik
- Windows nightly merge-receipt classification test exceeds 60-second budget Eintrag pm-v0600g
- GH-1327: Windows nightly static inventory unreadable-source assertion fails Eintrag pm-ft90q2
- GH-1326: Windows nightly bundled-package init test exceeds 30 seconds Eintrag pm-kvhnb5
- MCP detached task completion coverage can miss cleanup under hosted shards Eintrag pm-tm6h9x
- Full coverage refusal-closure retry test exceeds its four-minute budget under suite contention Eintrag pm-mrrci4
- GH-1328: linked-test execution does not disclose item evidence recording Eintrag pm-aao1hy
- GH-1330: per-command JSON help inherits the root intent and init example Eintrag pm-s8ztcl
- Refuse malformed settings writes with typed recovery Eintrag pm-z329kd
- Refuse local package installation when source scan stops at entry limit Eintrag pm-erogk1
- Allow self-isolating linked package tests without inherited PM_PATH Eintrag pm-t05d8d
- Preserve every tracker merge fence during nested init and detect lost active mappings Eintrag pm-kynkl8
Other
- Refresh September 27 compatible development dependency releases Eintrag pm-u9qqip
- Claude plugin spec-alignment hygiene vs 2026-07-11 official docs (minor, non-blocking) Eintrag pm-dudr
Fixed
- SDK complete-list receipt falsely reports legacy aliases for canonical helper Eintrag pm-vf9iaf
Other
- Consolidate workspace customization discovery and commands under workspace with permanent compatibility aliases Eintrag pm-npr3
- Declare workspace, templates and guide ownership with bounded agent orientation Eintrag pm-uk9dwh
- Dispatch daily releases at 04:45 Europe/Vienna with the hosted schedule as fallback Eintrag pm-9url9h
Other
- Adapt OpenClaw test-audit skill to pm SDK and repository test governance Eintrag pm-xvibt6
- Bound embedding requests, enforce retrieval floors, and protect schema previews Eintrag pm-g0b88h
Fixed
- GH-1306: Isolate merge driver installation and health across Git worktrees Eintrag pm-c1dwbt
- GH-1305: Preserve workflow policy refusal evidence and actionable missing-field recovery Eintrag pm-o5s22y
- GH-1303: Canonical help and refreshable agent guidance Eintrag pm-80k965
- GH-1304: Deterministic release pipeline branch coverage across hosted environments Eintrag pm-m2ai6c
- Scheduled auto-release has a chronically high failure rate and no rolling measure, so a degraded pipeline reads as healthy one run at a time Eintrag pm-e70zh5
- Daily auto-release never runs in its declared window: all 84 scheduled runs fired 2.5-4 hours after the cron time, so the release clock is undocumented drift Eintrag pm-44u3wt
- GH-1294: release commit omits synchronized plugin runtime manifests Eintrag pm-t4prek
- The related ceiling is pinned to the live count with block enforcement, so recording one associative sibling relation anywhere in the tracker fails CI while the share floor it duplicates would have allowed it Eintrag pm-r3o7x4
Security
- Semgrep 874840452: Medium dependabot missing cooldown in .github/dependabot.yml\#L3 Eintrag pm-gkut
- Semgrep 874840451: Medium dependabot missing cooldown in .github/dependabot.yml\#L23 Eintrag pm-dmo5
Fixed
- Dogfood test failure must not print inherited environment secrets Eintrag pm-jiv3dw
- Claude plugin: marketplace installs fall back to npx @latest, not the advertised native MCP server Eintrag pm-l9wl
- Windows copied agent plugins cannot install pinned runtime through npm.cmd Eintrag pm-d6fd85
- Nightly coverage, quality, and Windows tests exceed serial job budgets Eintrag pm-ul9rye
- GH-1291: Windows nightly release cleanup fixture includes Node compile cache Eintrag pm-puf5rq
Security
- Scorecard Token-Permissions (0→10): declare least-privilege top-level permissions in every GitHub workflow Eintrag pm-003j
Other
- Support safe Bash completion inside quoted and escaped prefixes Eintrag pm-eswzn9
- Refresh compatible Sentry, jscpd, and TypeScript-ESLint patches for September 22 Eintrag pm-hate9s
Other
- Mutation-testing gate: prove the 100 percent coverage suite actually detects defects, with a ratcheted mutation score on SDK core Eintrag pm-zclzll
