chore: replace semver with verkit

[theoephraim]

Replaces the semver dependency (plus @types/semver) with verkit — a zero-dependency, tree-shakeable SemVer library with native TypeScript types.

The API mapped nearly 1:1; the differences that needed handling:

• semver.prerelease(v) === null checks → isPrerelease(v): verkit's getPrerelease('1.2.3') returns [] rather than null for stable versions. The snapshot guard now uses isPrerelease(version) !== true, which also refuses invalid versions (previously only stable ones) — strictly safer.
• semver.parse returned null on invalid input; verkit's parse throws, so prerelease counter extraction uses tryParse. verkit also omits the prerelease field entirely for stable versions, so the counter check defaults it to [].
• Tests: semver.valid(v)).toBe(v) → normalize(v)).toBe(v), semver.lt → isLess.

Verified at runtime that satisfies/increment/compare match node-semver's contracts (string ranges accepted, false on invalid range, null on failed increment, throw on comparing invalid versions). verkit is bundled into dist by tsdown as a devDependency, same as semver was; releaseTriggeringDevDeps updated accordingly.

All 427 tests pass; typecheck, lint, and build are clean.

[pullfrog]

Run failed. View the logs →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using azure/gpt-5.6-sol ｜ 𝕏}

[github-actions]

The changes in this PR will be included in the next version bump.

Patch releases

• @varlock/bumpy 1.18.1 → 1.18.2

Bump files in this PR

• replace-semver-with-verkit.md (view diff) (edit)

Click here if you want to add another bump file to this PR

---

This comment is maintained by bumpy.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	verkit@​0.4.0

View full report