🐸 Versioned release

[bumpy-bot]

This PR was created and will be kept in sync by bumpy based on your bump files (in .bumpy/). Merge it when you are ready to release the packages listed below:

Minor releases

@varlock/bumpy 1.18.1 → 1.19.0 _CHANGELOG.md

• Added directBump: false per-package config for packages that only receive propagated bumps (e.g. platform binary packages in a fixed group with their core package) — they are excluded from bumpy add/bumpy generate, rejected when a bump file names them directly, and bumpy check points at their fixed-group members instead. Fixed groups now sync drifted members to a bump of the group's highest version so they reconverge. (bump file)
• Replaced the semver dependency with verkit — a smaller, tree-shakeable, zero-dependency SemVer library. No behavior changes, except invalid snapshot versions are now also refused (previously only stable versions were). (bump file)
• Fix bumpy ci comment failing to resolve the target PR for fork PRs. Under workflow_run, the PR was looked up via GET commits/{head_sha}/pulls, which only knows about commits in the base repo's own branches — for a fork PR it returns nothing, so the command exited with "Could not resolve a target PR" (defeating the whole point of the fork-safe pull_request + workflow_run split). When that lookup is empty, bumpy now scans the repo's open PRs (paginated) and matches head.sha against the trusted workflow_run.head_sha. The target still derives only from the trusted event, never from the artifact or from workflow_run.pull_requests[] (which GitHub leaves empty for forks). (bump file)
• Add bumpy ci deps for Dependabot / Renovate PRs (modeled on changesets-dependencies-action). It diffs each package's dependencies / peerDependencies / optionalDependencies (plus releaseTriggeringDevDeps, and catalog updates) against the base branch, writes one patch bump file per affected package listing the added / updated / removed deps, and commits + pushes them to the PR branch. Re-running is idempotent and removes stale files. bumpy generate --deps does the same locally without committing. (bump file)
  Also fix ci check on PRs into a channel branch: the package.json field diff and catalog diff compared against baseBranch instead of the PR's base, so dependency drift already merged into the channel was attributed to every later PR.
• Fixed prerelease counters restarting at .0 on registries that don't set a latest dist-tag (e.g. GCP Artifact Registry). npm info <name> versions resolves through latest and prints nothing when it's missing, so bumpy now falls back to the channel's dist-tag and warns if the version list still can't be read. Snapshot idempotency now checks the exact version, and the OIDC new-package check no longer misreports packages without latest as missing. (bump file)
• bumpy generate now maps commits that change a catalog entry (pnpm-workspace.yaml, .yarnrc.yml, root package.json) to the packages consuming it via catalog:, so a catalog bump produces the bump file bumpy check asks for. (bump file)