🐸 Versioned release

[github-actions]

This PR was created and will be kept in sync by bumpy based on your .bumpy bump files. Merge it when you are ready to release the packages listed below:

Major releases

@varlock/bumpy 0.0.2 → 1.0.0 _{package.json · CHANGELOG.md}

• Preserve package.json formatting when bumping versions (bump file)
  Instead of re-serializing the entire file with JSON.stringify, version bumps and dependency range updates now use targeted string replacements. This prevents reformatting issues like inline arrays being expanded to multi-line, indentation style changes, and other unnecessary churn.
• Restructured version propagation into Phase A/B/C architecture. Phase A (out-of-range fixes) always runs — peer deps now match the triggering bump level instead of always forcing major. Added workspace:^ protocol resolution for range checking. Removed minor-isolated and specificDependencyRules. Added none bump type and patch-isolated validation. Added warnings for ^0.x peer dep propagation and workspace:* on peer deps. (bump file)
• Add thankContributors option to the GitHub changelog formatter to disable "Thanks @user" messages entirely. Add dedicated changelog formatters docs page. (bump file)
• Fix "Bun is not defined" error in CI release command when running under Node.js by replacing Bun.CryptoHasher with node:crypto. (bump file)
• Add --pat-pr and --pat-comments flags to CI commands, allowing users to opt in to using BUMPY_GH_TOKEN for PR creation and comment posting. Also fixes CI not triggering on newly created version PRs. (bump file)
• Redesign bumpy add interactive UI with a unified bump level selector. Packages are shown in two groups (changed/unchanged), navigated with arrow keys, and bump levels cycled with left/right. Changed packages default to patch. (bump file)
• Removed patch-isolated bump type. The concept added complexity for minimal benefit — in most monorepos using ^ ranges, a patch bump already stays in range without triggering propagation. Users who need to prevent propagation can use per-package dependencyBumpRules config instead. (bump file)
• Fix internalAuthors option being ignored by the GitHub changelog formatter. The loadFormatter function matched the built-in "github" entry before reaching the options-aware path, so options like internalAuthors were silently dropped. (bump file)
• Security hardening: ephemeral git token auth, custom command gating via allowCustomCommands, bump file input validation, structured tarball path parsing, changelog formatter path traversal fix, and force-push safeguard (bump file)
• Bumpy v1 release (bump file)
• Fix force-push guard that was incorrectly comparing against HEAD instead of the configured base branch (bump file)
• Fix git push auth: revert to URL rewriting approach and add token redaction on errors (bump file)
• Fix git push auth failure caused by case-sensitive includeIf regex not matching lowercase keys from git config (bump file)