chore(deps-dev): bump @varlock/bumpy from 1.14.0 to 1.18.1

[dependabot]

Bumps @varlock/bumpy from 1.14.0 to 1.18.1.

Release notes

Sourced from @​varlock/bumpy's releases.

@​varlock/bumpy v1.18.1

• #149 (patch) Load Yarn catalogs from .yarnrc.yml. Yarn (>=4.10) stores catalog definitions in .yarnrc.yml under the catalog/catalogs keys (the same shape pnpm uses in pnpm-workspace.yaml), but catalog loading only read pnpm-workspace.yaml and package.json, so Yarn workspaces always saw an empty catalog map. Catalog loading and the check command's catalog diff now consult the package manager's own YAML file (.yarnrc.yml for Yarn).

Published to

• ✅ npm

@​varlock/bumpy v1.18.0

• #142 (minor) Add a pull_request + workflow_run option for commenting on fork PRs, so the privileged half never touches fork code. bumpy ci check --emit-comment <dir> renders the release-plan comment to <dir>/comment.md for upload as an artifact, and a new bumpy ci comment --body-file <path> posts it from a workflow_run job. The target PR is resolved from the trusted workflow_run event (head_sha), never from the (untrusted) artifact.

• #133 (minor) Add snapshot releases — transient, one-off preview publishes for private packages (the private-registry counterpart to pkg.pr.new).

  bumpy publish --snapshot <name> computes the pending release plan, derives a unique prerelease version per package (e.g. 1.4.0-pr-123-a1b2c3d), exact-pins in-plan internal deps, publishes to a non-latest dist-tag (default: the snapshot name), then restores the working tree. It never consumes bump files, writes changelogs, commits, creates git tags, or makes GitHub releases. bumpy ci release --snapshot <name> runs the whole thing and, on a PR, posts/updates a comment with the published versions and install instructions. Requires pending bump files; mutually exclusive with --channel.

  Version uniqueness is configurable via the new snapshot.versionStrategy option: "sha" (default — <target>-<name>-<short-sha>, idempotent per commit so re-runs skip) or "timestamp". Consumers install via the dist-tag regardless, so the exact version string is just an implementation detail.

Published to

• ✅ npm

@​varlock/bumpy v1.17.0

• #138 (minor) Added a global --cwd <dir> flag that runs bumpy as if it were started in <dir>. This makes the pull_request_target PR-check workflow safe against a previously-undocumented attack: a fork PR could commit a bunfig.toml/.npmrc that redirected where bunx @varlock/bumpy itself was fetched from (swapping in a malicious package at the pinned version). The recommended workflow now fetches and runs bumpy from a trusted base checkout and points it at the untrusted PR tree with --cwd ./pr, so package-manager config in the PR can no longer influence how bumpy is obtained.
• #140 (patch)

... (truncated)

Changelog

Sourced from @​varlock/bumpy's changelog.

1.18.1

2026-07-03

• #149 (patch) Load Yarn catalogs from .yarnrc.yml. Yarn (>=4.10) stores catalog definitions in .yarnrc.yml under the catalog/catalogs keys (the same shape pnpm uses in pnpm-workspace.yaml), but catalog loading only read pnpm-workspace.yaml and package.json, so Yarn workspaces always saw an empty catalog map. Catalog loading and the check command's catalog diff now consult the package manager's own YAML file (.yarnrc.yml for Yarn).

1.18.0

2026-06-26

• #133 (minor) Add snapshot releases — transient, one-off preview publishes for private packages (the private-registry counterpart to pkg.pr.new).

  bumpy publish --snapshot <name> computes the pending release plan, derives a unique prerelease version per package (e.g. 1.4.0-pr-123-a1b2c3d), exact-pins in-plan internal deps, publishes to a non-latest dist-tag (default: the snapshot name), then restores the working tree. It never consumes bump files, writes changelogs, commits, creates git tags, or makes GitHub releases. bumpy ci release --snapshot <name> runs the whole thing and, on a PR, posts/updates a comment with the published versions and install instructions. Requires pending bump files; mutually exclusive with --channel.

  Version uniqueness is configurable via the new snapshot.versionStrategy option: "sha" (default — <target>-<name>-<short-sha>, idempotent per commit so re-runs skip) or "timestamp". Consumers install via the dist-tag regardless, so the exact version string is just an implementation detail.

• #142 (minor) Add a pull_request + workflow_run option for commenting on fork PRs, so the privileged half never touches fork code. bumpy ci check --emit-comment <dir> renders the release-plan comment to <dir>/comment.md for upload as an artifact, and a new bumpy ci comment --body-file <path> posts it from a workflow_run job. The target PR is resolved from the trusted workflow_run event (head_sha), never from the (untrusted) artifact.

1.17.0

2026-06-25

• #138 (minor) Added a global --cwd <dir> flag that runs bumpy as if it were started in <dir>. This makes the pull_request_target PR-check workflow safe against a previously-undocumented attack: a fork PR could commit a bunfig.toml/.npmrc that redirected where bunx @varlock/bumpy itself was fetched from (swapping in a malicious package at the pinned version). The recommended workflow now fetches and runs bumpy from a trusted base checkout and points it at the untrusted PR tree with --cwd ./pr, so package-manager config in the PR can no longer influence how bumpy is obtained.

1.16.1

2026-06-25

• #136 (patch) Fixed GitHub release notes coming up empty (No changelog entries.) when the publish ran several commits after the version commit — e.g. a retry after the first publish was blocked and unrelated fixes landed on main. Bump-file recovery assumed the version commit was always HEAD~1..HEAD; it now locates the most recent commit that actually deleted bump files and recovers their content from that commit's parent, so release notes are populated regardless of how far HEAD has moved past versioning.

1.16.0

2026-06-23

• #131 (minor) Added a $changelog: false reserved frontmatter key for bump files, which omits a file's body from the changelog and release notes while still applying its version bump. Clearer than relying on a blank body, and lets you keep notes for reviewers. A per-package changelog: false option in the nested form suppresses the entry for just some of a file's packages.

1.15.2

2026-06-23

• #129 (patch) Degrade the version PR body when it would exceed GitHub's 65536-character limit (which previously failed the release for large multi-package releases). The body now drops inline change summaries — and hard-truncates as a last resort — instead of erroring.

1.15.1

... (truncated)

Commits

• 104bb63 🐸 Versioned release (#150)
• 4960ffc fix: load Yarn catalogs from .yarnrc.yml (#148) (#149)
• 13ab7cb 🐸 Versioned release (#143)
• dc87355 feat: fork-PR comments via pull_request + workflow_run split (+ checkout@v7 d...
• 3bff4dc Snapshot releases for private packages (#133)
• 4f1b5b6 🐸 Versioned release (#139)
• ad1d59f feat: ci check fails under pull_request_target without --cwd (#140)
• 98ef1f2 fix: harden pull_request_target check against bunfig/npmrc registry redirect ...
• 22c16f3 🐸 Versioned release (#137)
• 34508a4 fix: recover bump files from the version commit even when HEAD has moved past...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[netlify]

✅ Deploy Preview for typedcss-validator ready!

Name	Link
🔨 Latest commit	7ed0463
🔍 Latest deploy log	https://app.netlify.com/projects/typedcss-validator/deploys/6a763abdbd7c93000864da89
😎 Deploy Preview	https://deploy-preview-161--typedcss-validator.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​varlock/​bumpy@​1.18.1

View full report