chore(deps-dev): bump @varlock/bumpy from 1.13.2 to 1.14.0

[dependabot]

Bumps @varlock/bumpy from 1.13.2 to 1.14.0.

Release notes

Sourced from @​varlock/bumpy's releases.

@​varlock/bumpy v1.14.0

• (minor) - Add prerelease channels — branch-based prerelease lines (e.g. next → @next dist-tag) where prerelease versions are never committed to git. Targets derive from bump files, counters from the registry; shipped bump files are tracked by moving them into .bumpy/<channel>/. Includes channel-aware version / publish / status / ci release flows, exact-pinned lockstep cycle publishes, and promotion-by-merge to stable.
• #115 (patch) - When a prerelease cycle is promoted (channel → main) or graduated (channel → channel), any lingering release PR on the source channel is now closed automatically with an explanatory comment — merging it would have offered another prerelease of a cycle that already moved on.
• #110 (patch) - ci check now reads bump files in channel directories, so promotion PRs (channel → main) and graduation PRs (channel → channel) correctly report the cycle's pending releases instead of failing with "no bump files found". Channel-dir bump files render with their subdir path (next/feature.md) so view/edit links resolve.
• (patch) - Channel release PR titles and bodies now show deterministic versions: targets with a wildcard counter (1.2.0-rc.x) derived purely from committed state, instead of registry-derived counters that could drift between PR creation and publish. Multi-package cycles show a package count in the title instead of an arbitrary lead package. The PR check comment and version output use the same .x wildcard; status / ci plan still show live registry-derived counters (.? when offline).
• #110 (patch) - The PR check comment now explicitly calls out promotion PRs (channel → stable): the headline explains that merging ends the prerelease cycle and ships stable, and bump files that already shipped on a channel are annotated with their dist-tag (e.g. next/feature.md (shipped on @next)).

Published to

• ✅ npm

@​varlock/bumpy v1.14.0-rc.1

• #104 (minor) - Add prerelease channels — branch-based prerelease lines (e.g. next → @next dist-tag) where prerelease versions are never committed to git. Targets derive from bump files, counters from the registry; shipped bump files are tracked by moving them into .bumpy/<channel>/. Includes channel-aware version / publish / status / ci release flows, exact-pinned lockstep cycle publishes, and promotion-by-merge to stable.
• #107 (patch) - Channel release PR titles and bodies now show deterministic versions: targets with a wildcard counter (1.2.0-rc.x) derived purely from committed state, instead of registry-derived counters that could drift between PR creation and publish. Multi-package cycles show a package count in the title instead of an arbitrary lead package. The PR check comment and version output use the same .x wildcard; status / ci plan still show live registry-derived counters (.? when offline).

Published to

• ✅ npm

@​varlock/bumpy v1.14.0-rc.0

• #104 (minor) - Add prerelease channels — branch-based prerelease lines (e.g. next → @next dist-tag) where prerelease versions are never committed to git. Targets derive from bump files, counters from the registry; shipped bump files are tracked by moving them into .bumpy/<channel>/. Includes channel-aware version / publish / status / ci release flows, exact-pinned lockstep cycle publishes, and promotion-by-merge to stable.

Published to

• ✅ npm

... (truncated)

Changelog

Sourced from @​varlock/bumpy's changelog.

1.14.0

2026-06-13

• (minor) - Add prerelease channels — branch-based prerelease lines (e.g. next → @next dist-tag) where prerelease versions are never committed to git. Targets derive from bump files, counters from the registry; shipped bump files are tracked by moving them into .bumpy/<channel>/. Includes channel-aware version / publish / status / ci release flows, exact-pinned lockstep cycle publishes, and promotion-by-merge to stable.
• #110 (patch) - ci check now reads bump files in channel directories, so promotion PRs (channel → main) and graduation PRs (channel → channel) correctly report the cycle's pending releases instead of failing with "no bump files found". Channel-dir bump files render with their subdir path (next/feature.md) so view/edit links resolve.
• (patch) - Channel release PR titles and bodies now show deterministic versions: targets with a wildcard counter (1.2.0-rc.x) derived purely from committed state, instead of registry-derived counters that could drift between PR creation and publish. Multi-package cycles show a package count in the title instead of an arbitrary lead package. The PR check comment and version output use the same .x wildcard; status / ci plan still show live registry-derived counters (.? when offline).
• #110 (patch) - The PR check comment now explicitly calls out promotion PRs (channel → stable): the headline explains that merging ends the prerelease cycle and ships stable, and bump files that already shipped on a channel are annotated with their dist-tag (e.g. next/feature.md (shipped on @next)).
• #115 (patch) - When a prerelease cycle is promoted (channel → main) or graduated (channel → channel), any lingering release PR on the source channel is now closed automatically with an explanatory comment — merging it would have offered another prerelease of a cycle that already moved on.

Commits

• 0a9292c 🐸 Versioned release (#114)
• d687bef feat: auto-close promoted channel release PRs (#115)
• 60e1f7a Promote next channel to stable (@​varlock/bumpy 1.14.0) (#110)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[netlify]

✅ Deploy Preview for typedcss-validator ready!

Name	Link
🔨 Latest commit	9051df0
🔍 Latest deploy log	https://app.netlify.com/projects/typedcss-validator/deploys/6a31acb2adb6b00008b6f4cc
😎 Deploy Preview	https://deploy-preview-130--typedcss-validator.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​varlock/​bumpy@​1.14.0

View full report