From 47d481c367701328b96c4d0cd7c498d3a9a36820 Mon Sep 17 00:00:00 2001
From: bumpy-bot <276066384+bumpy-bot@users.noreply.github.com>
Date: Thu, 17 Sep 2026 17:01:11 +0000
Subject: [PATCH] Version packages
@varlock/bumpy@1.19.0
---
.bumpy/ci-comment-fork-pr-resolution.md | 5 -----
.bumpy/direct-bump-and-fixed-sync.md | 5 -----
.bumpy/replace-semver-with-verkit.md | 5 -----
bun.lock | 2 +-
packages/bumpy/CHANGELOG.md | 11 +++++++++++
packages/bumpy/package.json | 2 +-
6 files changed, 13 insertions(+), 17 deletions(-)
delete mode 100644 .bumpy/ci-comment-fork-pr-resolution.md
delete mode 100644 .bumpy/direct-bump-and-fixed-sync.md
delete mode 100644 .bumpy/replace-semver-with-verkit.md
diff --git a/.bumpy/ci-comment-fork-pr-resolution.md b/.bumpy/ci-comment-fork-pr-resolution.md
deleted file mode 100644
index b2e756b..0000000
--- a/.bumpy/ci-comment-fork-pr-resolution.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@varlock/bumpy': patch
----
-
-Fix `bumpy ci comment` failing to resolve the target PR for fork PRs. Under `workflow_run`, the PR was looked up via `GET commits/{head_sha}/pulls`, which only knows about commits in the base repo's own branches — for a fork PR it returns nothing, so the command exited with "Could not resolve a target PR" (defeating the whole point of the fork-safe `pull_request` + `workflow_run` split). When that lookup is empty, bumpy now scans the repo's open PRs (paginated) and matches `head.sha` against the trusted `workflow_run.head_sha`. The target still derives only from the trusted event, never from the artifact or from `workflow_run.pull_requests[]` (which GitHub leaves empty for forks).
diff --git a/.bumpy/direct-bump-and-fixed-sync.md b/.bumpy/direct-bump-and-fixed-sync.md
deleted file mode 100644
index 5999833..0000000
--- a/.bumpy/direct-bump-and-fixed-sync.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@varlock/bumpy': minor
----
-
-Added `directBump: false` per-package config for packages that only receive propagated bumps (e.g. platform binary packages in a fixed group with their core package) — they are excluded from `bumpy add`/`bumpy generate`, rejected when a bump file names them directly, and `bumpy check` points at their fixed-group members instead. Fixed groups now sync drifted members to a bump of the group's highest version so they reconverge.
diff --git a/.bumpy/replace-semver-with-verkit.md b/.bumpy/replace-semver-with-verkit.md
deleted file mode 100644
index 4af93cc..0000000
--- a/.bumpy/replace-semver-with-verkit.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@varlock/bumpy': patch
----
-
-Replaced the `semver` dependency with [verkit](https://github.com/sxzz/verkit) — a smaller, tree-shakeable, zero-dependency SemVer library. No behavior changes, except invalid snapshot versions are now also refused (previously only stable versions were).
diff --git a/bun.lock b/bun.lock
index d14c42d..f52fbf4 100644
--- a/bun.lock
+++ b/bun.lock
@@ -14,7 +14,7 @@
},
"packages/bumpy": {
"name": "@varlock/bumpy",
- "version": "1.18.1",
+ "version": "1.19.0",
"bin": {
"bumpy": "./dist/cli.mjs",
},
diff --git a/packages/bumpy/CHANGELOG.md b/packages/bumpy/CHANGELOG.md
index 2ed0cbe..39b0681 100644
--- a/packages/bumpy/CHANGELOG.md
+++ b/packages/bumpy/CHANGELOG.md
@@ -1,5 +1,16 @@
# Changelog
+## 1.19.0
+
+2026-09-17
+
+- [#155](https://github.com/dmno-dev/bumpy/pull/155) _(minor)_
+ Added `directBump: false` per-package config for packages that only receive propagated bumps (e.g. platform binary packages in a fixed group with their core package) — they are excluded from `bumpy add`/`bumpy generate`, rejected when a bump file names them directly, and `bumpy check` points at their fixed-group members instead. Fixed groups now sync drifted members to a bump of the group's highest version so they reconverge.
+- [#158](https://github.com/dmno-dev/bumpy/pull/158) _(patch)_
+ Replaced the `semver` dependency with [verkit](https://github.com/sxzz/verkit) — a smaller, tree-shakeable, zero-dependency SemVer library. No behavior changes, except invalid snapshot versions are now also refused (previously only stable versions were).
+- [#160](https://github.com/dmno-dev/bumpy/pull/160) _(patch)_
+ Fix `bumpy ci comment` failing to resolve the target PR for fork PRs. Under `workflow_run`, the PR was looked up via `GET commits/{head_sha}/pulls`, which only knows about commits in the base repo's own branches — for a fork PR it returns nothing, so the command exited with "Could not resolve a target PR" (defeating the whole point of the fork-safe `pull_request` + `workflow_run` split). When that lookup is empty, bumpy now scans the repo's open PRs (paginated) and matches `head.sha` against the trusted `workflow_run.head_sha`. The target still derives only from the trusted event, never from the artifact or from `workflow_run.pull_requests[]` (which GitHub leaves empty for forks).
+
## 1.18.1
2026-07-03
diff --git a/packages/bumpy/package.json b/packages/bumpy/package.json
index e9cb19f..28e88e4 100644
--- a/packages/bumpy/package.json
+++ b/packages/bumpy/package.json
@@ -1,6 +1,6 @@
{
"name": "@varlock/bumpy",
- "version": "1.18.1",
+ "version": "1.19.0",
"description": "Modern monorepo versioning and changelog tool",
"keywords": [
"bump",