versionary 0.32.0 → 1.0.0

package/dist/action/index.js

@@ -57,9 +57,9 @@ function setOutput(name, value) {
     appendFileSync(outputPath, `${name}<<${delimiter}\n${value}\n${delimiter}\n`, "utf8");
 }
 function main() {
-    const token = getInput("token") || getInput("github-token");
+    const token = getInput("token");
     if (!token) {
-        throw new Error("Input required and not supplied: token (or deprecated github-token).");
+        throw new Error("Input required and not supplied: token.");
     }
     const versionaryVersion = getInput("versionary-version") || "0.7.0";
     const cwd = getInput("working-directory") || ".";

package/dist/cli/index.js

@@ -1,9 +1,8 @@
 #!/usr/bin/env node
 import { execFileSync } from "node:child_process";
-import { loadConfig } from "../config/load-config.js";
 import { prependChangelog, renderReleasePlanChangelog, } from "../release/changelog.js";
 import { createReleasePlan } from "../release/plan.js";
-import { closeStaleReviewRequestIfExists, consumeNextReleaseFile, isReleaseCommitMessage, openOrUpdateReviewRequest, prepareReleasePr, pushReleaseBranch, resolveReleaseHighlights, } from "../release/pr.js";
+import { closeStaleReviewRequestIfExists, isReleaseCommitMessage, openOrUpdateReviewRequest, prepareReleasePr, pushReleaseBranch, resolveReleaseHighlights, } from "../release/pr.js";
 import { runRelease, runReleaseDetailed } from "../release/release.js";
 import { verifyProject } from "../release/verify-project.js";
 function printVerifyResult() {
@@ -195,8 +194,7 @@ async function main() {
             console.log("No releasable commits found.");
             return 0;
         }
-        const loaded = loadConfig();
-        const highlightsResult = resolveReleaseHighlights(process.cwd(), loaded.config, plan.changelogFile, plan.changelogFormat, logger);
+        const highlightsResult = resolveReleaseHighlights(process.cwd(), plan.changelogFile, plan.changelogFormat);
         const section = renderReleasePlanChangelog(plan, {
             highlights: highlightsResult.highlights,
         });
@@ -205,9 +203,6 @@ async function main() {
             return 0;
         }
         prependChangelog(process.cwd(), plan.changelogFile, section, plan.changelogFormat);
-        if (highlightsResult.source === "file" && highlightsResult.filePath) {
-            consumeNextReleaseFile(process.cwd(), highlightsResult.filePath);
-        }
         console.log(`Updated ${plan.changelogFile}`);
         return 0;
     }

package/dist/config/schema.d.ts

@@ -5,7 +5,6 @@ export declare const configSchema: z.ZodObject<{
     "review-mode": z.ZodOptional<z.ZodEnum<{
         direct: "direct";
         pr: "pr";
-        review: "review";
     }>>;
     "version-file": z.ZodOptional<z.ZodString>;
     "changelog-file": z.ZodOptional<z.ZodString>;
@@ -15,17 +14,16 @@ export declare const configSchema: z.ZodObject<{
     }>>;
     "release-draft": z.ZodOptional<z.ZodBoolean>;
     "release-reference-comments": z.ZodOptional<z.ZodEnum<{
-        off: "off";
         "best-effort": "best-effort";
+        off: "off";
         strict: "strict";
     }>>;
     "release-branch": z.ZodOptional<z.ZodString>;
     "baseline-file": z.ZodOptional<z.ZodString>;
-    "next-release-file": z.ZodOptional<z.ZodString>;
     "bootstrap-sha": z.ZodOptional<z.ZodString>;
     "monorepo-mode": z.ZodOptional<z.ZodEnum<{
-        independent: "independent";
         fixed: "fixed";
+        independent: "independent";
     }>>;
     "bump-minor-pre-major": z.ZodOptional<z.ZodBoolean>;
     "allow-stable-major": z.ZodOptional<z.ZodBoolean>;
@@ -45,14 +43,13 @@ export declare const configSchema: z.ZodObject<{
         "extra-files": z.ZodOptional<z.ZodArray<z.ZodObject<{
             type: z.ZodEnum<{
                 json: "json";
-                toml: "toml";
-                yaml: "yaml";
                 nix: "nix";
                 regex: "regex";
+                toml: "toml";
+                yaml: "yaml";
             }>;
             path: z.ZodString;
             "field-path": z.ZodOptional<z.ZodString>;
-            jsonpath: z.ZodOptional<z.ZodString>;
             pattern: z.ZodOptional<z.ZodString>;
             replacement: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>>;

package/dist/config/schema.js

@@ -4,44 +4,35 @@ const artifactRuleSchema = z
     type: z.enum(["json", "toml", "yaml", "nix", "regex"]),
     path: z.string().min(1),
     "field-path": z.string().optional(),
-    jsonpath: z.string().optional(),
     pattern: z.string().optional(),
     replacement: z.string().optional(),
 })
     .superRefine((value, ctx) => {
-    const needsJsonPath = value.type === "json" ||
+    const needsFieldPath = value.type === "json" ||
         value.type === "toml" ||
         value.type === "yaml" ||
         value.type === "nix";
-    const hasFieldPath = Boolean(value["field-path"] ?? value.jsonpath);
-    if (needsJsonPath && !hasFieldPath) {
+    if (needsFieldPath && !value["field-path"]) {
         ctx.addIssue({
             code: z.ZodIssueCode.custom,
-            message: `${value.type} artifact rules require "field-path" (or deprecated "jsonpath").`,
+            message: `${value.type} artifact rules require "field-path".`,
             path: ["field-path"],
         });
     }
-    if (needsJsonPath && value.pattern) {
+    if (needsFieldPath && value.pattern) {
         ctx.addIssue({
             code: z.ZodIssueCode.custom,
             message: `${value.type} artifact rules do not support "pattern".`,
             path: ["pattern"],
         });
     }
-    if (needsJsonPath && value.replacement) {
+    if (needsFieldPath && value.replacement) {
         ctx.addIssue({
             code: z.ZodIssueCode.custom,
             message: `${value.type} artifact rules do not support "replacement".`,
             path: ["replacement"],
         });
     }
-    if (value["field-path"] && value.jsonpath) {
-        ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: 'Specify only one of "field-path" or deprecated "jsonpath".',
-            path: ["field-path"],
-        });
-    }
     if (value.type === "regex" && !value.pattern) {
         ctx.addIssue({
             code: z.ZodIssueCode.custom,
@@ -49,10 +40,10 @@ const artifactRuleSchema = z
             path: ["pattern"],
         });
     }
-    if (value.type === "regex" && (value["field-path"] || value.jsonpath)) {
+    if (value.type === "regex" && value["field-path"]) {
         ctx.addIssue({
             code: z.ZodIssueCode.custom,
-            message: 'regex artifact rules do not support "field-path" or deprecated "jsonpath".',
+            message: 'regex artifact rules do not support "field-path".',
             path: ["field-path"],
         });
     }
@@ -75,7 +66,7 @@ export const configSchema = z
     .object({
     $schema: z.string().optional(),
     version: z.literal(1),
-    "review-mode": z.enum(["direct", "pr", "review"]).optional(),
+    "review-mode": z.enum(["direct", "pr"]).optional(),
     "version-file": z.string().optional(),
     "changelog-file": z.string().optional(),
     "changelog-format": z.enum(["markdown-changelog", "r-news"]).optional(),
@@ -85,7 +76,6 @@ export const configSchema = z
         .optional(),
     "release-branch": z.string().optional(),
     "baseline-file": z.string().optional(),
-    "next-release-file": z.string().optional(),
     "bootstrap-sha": z.string().optional(),
     "monorepo-mode": z.enum(["independent", "fixed"]).optional(),
     "bump-minor-pre-major": z.boolean().optional(),

package/dist/release/artifact-rules.d.ts

@@ -1,3 +1,3 @@
 import type { VersionaryConfig } from "../types/config.js";
-import type { SimplePlan } from "./plan.js";
-export declare function applyConfiguredArtifactRules(cwd: string, config: VersionaryConfig, plan: SimplePlan): string[];
+import type { ReleasePlan } from "./plan.js";
+export declare function applyConfiguredArtifactRules(cwd: string, config: VersionaryConfig, plan: ReleasePlan): string[];

package/dist/release/artifact-rules.js

@@ -143,9 +143,9 @@ function setVersionAtJsonPath(document, fieldPath, version) {
     }
 }
 function resolveFieldPath(rule) {
-    const fieldPath = rule["field-path"] ?? rule.jsonpath;
+    const fieldPath = rule["field-path"];
     if (!fieldPath) {
-        throw new Error(`${rule.type} artifact rules require "field-path" (or deprecated "jsonpath").`);
+        throw new Error(`${rule.type} artifact rules require "field-path".`);
     }
     return fieldPath;
 }
@@ -207,8 +207,8 @@ function applyRegexRule(content, pattern, version, replacementTemplate) {
         const rendered = renderReplacementTemplate(replacementTemplate, version);
         return `${content.slice(0, start)}${rendered}${content.slice(start + full.length)}`;
     }
-    // Legacy behavior: substitute the full version into the first capture group,
-    // leaving the rest of the match intact. Splice by group indices rather than
+    // Without a template: substitute the full version into the first capture
+    // group, leaving the rest of the match intact. Splice by group indices rather than
     // `String.replace` so literal `$` sequences and repeated group content are
     // handled correctly.
     const groupIndices = match.indices?.[1];

package/dist/release/changelog.d.ts

@@ -1,6 +1,6 @@
 import { type ParsedCommit } from "../git/commits.js";
 import type { VersionaryChangelogFormat } from "../types/config.js";
-import { type ReleasePlan, type SimplePlan } from "./plan.js";
+import { type ReleasePlan } from "./plan.js";
 export declare function renderReleaseNotesSection(input: {
     currentVersion: string;
     nextVersion: string;
@@ -23,8 +23,6 @@ export declare function renderReleasePlanChangelog(plan: ReleasePlan, options?:
     cwd?: string;
     highlights?: string;
 }): string;
-/** @deprecated Use renderReleasePlanChangelog. */
-export declare function renderSimpleChangelog(plan: SimplePlan): string;
 /**
  * Locate a manual-notes block at the top of an existing changelog and split it
  * out. The notes block is the first release-level heading whose text is not a

package/dist/release/changelog.js

@@ -2,7 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { applyRevertSuppression, inferReleaseTypeFromParsedCommit, parseConventionalCommitMessage, } from "../git/commits.js";
 import { resolveRepositoryWebBaseUrl } from "../git/repo-url.js";
-import { resolvePackageDependencies, } from "./plan.js";
+import { resolvePackageDependencies } from "./plan.js";
 import { isVersionHeading } from "./semver.js";
 const REVIEW_REQUEST_FOOTER = "---\n\nThis PR was generated by [Versionary](https://github.com/jolars/versionary).";
 function formatDate() {
@@ -68,6 +68,7 @@ function groupCommitLines(commits, repoUrl) {
     const fixes = [];
     const performance = [];
     const reverts = [];
+    const other = [];
     const effectiveCommits = applyRevertSuppression(commits);
     const getRevertedSubject = (commit) => {
         const normalizedDescription = (commit.description ?? "")
@@ -93,9 +94,6 @@ function groupCommitLines(commits, repoUrl) {
     };
     for (const commit of effectiveCommits) {
         const type = inferReleaseTypeFromParsedCommit(commit);
-        if (!type) {
-            continue;
-        }
         const { label, message } = formatCommitMessage(commit.subject);
         const short = commit.hash.slice(0, 7);
         const hashLabel = repoUrl
@@ -106,6 +104,10 @@ function groupCommitLines(commits, repoUrl) {
         const line = `- ${label}${message} (${hashLabel})${referencesSuffix}`;
         const commitType = (commit.type ?? "").toLowerCase();
         const isBreaking = type === "major";
+        if (!type) {
+            other.push(line);
+            continue;
+        }
         if (commit.isRevert) {
             if (!shouldIncludeRevert(commit)) {
                 continue;
@@ -128,7 +130,23 @@ function groupCommitLines(commits, repoUrl) {
             fixes.push(line);
         }
     }
-    return { breaking, features, fixes, performance, reverts };
+    return { breaking, features, fixes, performance, reverts, other };
+}
+/**
+ * A forced bump — a stale dependency, or a propagated requirement rewrite —
+ * can carry no release-worthy commits at all. Rather than publish a bare
+ * version heading, such a release falls back to listing whatever else is
+ * shipping under it.
+ */
+function needsOtherChangesFallback(grouped, hasHighlights, dependencyCount) {
+    if (hasHighlights || dependencyCount > 0 || grouped.other.length === 0) {
+        return false;
+    }
+    return (grouped.breaking.length === 0 &&
+        grouped.features.length === 0 &&
+        grouped.fixes.length === 0 &&
+        grouped.performance.length === 0 &&
+        grouped.reverts.length === 0);
 }
 export function renderReleaseNotesSection(input, options = {}) {
     const repoUrl = resolveRepositoryWebBaseUrl(input.cwd ?? process.cwd());
@@ -161,6 +179,9 @@ export function renderReleaseNotesSection(input, options = {}) {
     if (input.dependencies && input.dependencies.length > 0) {
         sections.push("### Dependencies", ...input.dependencies.map((dependency) => `- updated ${dependency.name} to v${dependency.version}`), "");
     }
+    if (needsOtherChangesFallback(grouped, trimmedHighlights.length > 0, input.dependencies?.length ?? 0)) {
+        sections.push("### Other changes", ...grouped.other, "");
+    }
     const body = [header, "", ...sections].join("\n").trimEnd();
     if (options.includeFooter) {
         return `${body}\n\n${renderReviewRequestFooter()}`;
@@ -198,10 +219,6 @@ export function renderReleasePlanChangelog(plan, options = {}) {
         includeFooter: options.includeFooter,
     });
 }
-/** @deprecated Use renderReleasePlanChangelog. */
-export function renderSimpleChangelog(plan) {
-    return renderReleasePlanChangelog(plan);
-}
 /**
  * Locate a manual-notes block at the top of an existing changelog and split it
  * out. The notes block is the first release-level heading whose text is not a
@@ -292,6 +309,9 @@ export function renderRNewsReleaseNotes(input) {
     if (grouped.reverts.length > 0) {
         sections.push("## Reverts", "", ...grouped.reverts, "");
     }
+    if (needsOtherChangesFallback(grouped, trimmedHighlights.length > 0, 0)) {
+        sections.push("## Other changes", "", ...grouped.other, "");
+    }
     return [`# ${input.packageName} ${normalizedVersion}`, "", ...sections]
         .join("\n")
         .trimEnd();

package/dist/release/plan.d.ts

@@ -1,6 +1,7 @@
 import { type ParsedCommit } from "../git/commits.js";
 import type { VersionaryChangelogFormat, VersionaryConfig } from "../types/config.js";
 import { type ReleaseType } from "./semver.js";
+type BumpReason = "direct" | "dependency-propagation" | "stale-dependency" | "follows" | "release-as";
 export interface ReleasePlan {
     mode: "simple";
     releaseType: ReleaseType;
@@ -18,13 +19,11 @@ export interface ReleasePlan {
         releaseType: ReleaseType;
         currentVersion: string;
         nextVersion: string | null;
-        bumpReason?: "direct" | "dependency-propagation" | "follows";
+        bumpReason?: BumpReason;
         dependencySourcePaths?: string[];
         commits: ParsedCommit[];
     }>;
 }
-/** @deprecated Use ReleasePlan. */
-export type SimplePlan = ReleasePlan;
 export declare function getChangelogDefaults(config: {
     "release-type"?: VersionaryConfig["release-type"];
     "changelog-file"?: VersionaryConfig["changelog-file"];
@@ -35,9 +34,8 @@ export declare function getChangelogDefaults(config: {
     changelogFormat: VersionaryChangelogFormat;
 };
 export declare function createReleasePlan(cwd?: string): ReleasePlan;
-/** @deprecated Use createReleasePlan. */
-export declare function createSimplePlan(cwd?: string): ReleasePlan;
 export declare function resolvePackageDependencies(plan: ReleasePlan, packagePath: string): Array<{
     name: string;
     version: string;
 }>;
+export {};

package/dist/release/plan.js

@@ -4,6 +4,7 @@ import { loadConfig } from "../config/load-config.js";
 import { analyzeParsedCommits, applyRevertSuppression, getParsedCommitsForPath, getParsedCommitsSinceLastTag, } from "../git/commits.js";
 import { resolvePackageStrategyContext } from "../strategy/package-context.js";
 import { resolveVersionStrategy } from "../strategy/resolve.js";
+import { releaseTypeBetween, resolveReleaseAsOverride } from "./release-as.js";
 import { bumpVersion, maxReleaseType } from "./semver.js";
 import { readBaselineSha, readReleaseTargets } from "./state.js";
 function getMode(configMode) {
@@ -78,19 +79,34 @@ export function createReleasePlan(cwd = process.cwd()) {
         }
         const effectiveCommits = applyRevertSuppression(parsedCommits);
         const commits = effectiveCommits;
-        const releaseType = analyzeParsedCommits(parsedCommits);
-        const nextVersion = releaseType
-            ? bumpVersion(packageCurrentVersion, releaseType, {
-                allowStableMajor: allowStableMajorForPath(pkg.path),
-            })
-            : null;
+        const analyzedType = analyzeParsedCommits(parsedCommits);
+        const override = resolveReleaseAsOverride(commits, packageCurrentVersion);
+        let releaseType;
+        let nextVersion;
+        let bumpReason;
+        if (override) {
+            // An explicit `Release-As:` footer forces a release with the requested
+            // version, even when the conventional-commit analysis produces no bump.
+            nextVersion = override.version;
+            releaseType = releaseTypeBetween(packageCurrentVersion, override.version);
+            bumpReason = "release-as";
+        }
+        else {
+            releaseType = analyzedType;
+            nextVersion = releaseType
+                ? bumpVersion(packageCurrentVersion, releaseType, {
+                    allowStableMajor: allowStableMajorForPath(pkg.path),
+                })
+                : null;
+            bumpReason = nextVersion ? "direct" : undefined;
+        }
         return {
             path: pkg.path,
             implicitRoot: pkg.implicitRoot,
             releaseType,
             currentVersion: packageCurrentVersion,
             nextVersion,
-            bumpReason: nextVersion ? "direct" : undefined,
+            bumpReason,
             commits,
             parsedCommits,
             resolvedVersionFile: packageContext.versionFile,
@@ -119,39 +135,179 @@ export function createReleasePlan(cwd = process.cwd()) {
         ...(implicitRootPlan ? [implicitRootPlan] : []),
     ].sort((a, b) => a.path.localeCompare(b.path));
     const packageCurrentVersionByPath = {};
-    const packageNextVersionByPath = {};
     const strategyPackagesByName = new Map();
+    // Strategy contexts are shared by reference with their group so that forcing
+    // a bump during the fixpoint below is immediately visible to the next
+    // `propagateDependentPatchImpacts` query.
+    const strategyContextByPath = new Map();
+    const strategyByPath = new Map();
     for (const packagePlan of packagePlans) {
         const packageConfig = loaded.config.packages?.[packagePlan.path] ?? {};
         const packageContext = resolvePackageStrategyContext(loaded.config, packagePlan.path, packageConfig);
+        const strategyContext = {
+            packagePath: packagePlan.path,
+            versionFile: packagePlan.resolvedVersionFile,
+            currentVersion: packagePlan.currentVersion,
+            nextVersion: packagePlan.nextVersion,
+        };
+        strategyContextByPath.set(packagePlan.path, strategyContext);
+        strategyByPath.set(packagePlan.path, packageContext.strategy);
         const existingGroup = strategyPackagesByName.get(packageContext.strategy.name);
         if (existingGroup) {
-            existingGroup.packages.push({
-                packagePath: packagePlan.path,
-                versionFile: packagePlan.resolvedVersionFile,
-                currentVersion: packagePlan.currentVersion,
-                nextVersion: packagePlan.nextVersion,
-            });
+            existingGroup.packages.push(strategyContext);
         }
         else {
             strategyPackagesByName.set(packageContext.strategy.name, {
                 strategy: packageContext.strategy,
-                packages: [
-                    {
-                        packagePath: packagePlan.path,
-                        versionFile: packagePlan.resolvedVersionFile,
-                        currentVersion: packagePlan.currentVersion,
-                        nextVersion: packagePlan.nextVersion,
-                    },
-                ],
+                packages: [strategyContext],
             });
         }
         packageCurrentVersionByPath[packagePlan.path] = packagePlan.currentVersion;
-        if (packagePlan.nextVersion) {
-            packageNextVersionByPath[packagePlan.path] = packagePlan.nextVersion;
+    }
+    const workingPlans = packagePlans.map((pkgPlan) => ({ ...pkgPlan }));
+    const workingPlanByPath = new Map(workingPlans.map((pkgPlan) => [pkgPlan.path, pkgPlan]));
+    const forcePatchBump = (target, reason) => {
+        const current = packageCurrentVersionByPath[target.path] ?? target.currentVersion;
+        target.releaseType = "patch";
+        target.nextVersion = bumpVersion(current, "patch", {
+            allowStableMajor: allowStableMajorForPath(target.path),
+        });
+        target.bumpReason = reason;
+        const strategyContext = strategyContextByPath.get(target.path);
+        if (strategyContext) {
+            strategyContext.nextVersion = target.nextVersion;
+        }
+    };
+    /**
+     * Packages that record a version requirement on `sourcePath`, found by
+     * asking the strategy who would need a requirement rewrite if `sourcePath`
+     * alone released. Works whether or not `sourcePath` is currently bumping,
+     * so it doubles as a reverse-edge lookup for a package that has not entered
+     * the plan yet.
+     */
+    const findDependents = (sourcePath) => {
+        const strategyContext = strategyContextByPath.get(sourcePath);
+        // The implicit root can name a version file that does not exist. Nothing
+        // can record a requirement on a package that has no manifest, and asking
+        // the strategy would make it read one.
+        if (!strategyContext ||
+            !fs.existsSync(path.join(cwd, strategyContext.versionFile))) {
+            return [];
+        }
+        const strategy = strategyByPath.get(sourcePath);
+        const strategyGroup = strategy
+            ? strategyPackagesByName.get(strategy.name)
+            : undefined;
+        if (!strategyGroup?.strategy.propagateDependentPatchImpacts) {
+            return [];
+        }
+        const hypotheticalVersion = strategyContext.nextVersion ??
+            bumpVersion(packageCurrentVersionByPath[sourcePath] ??
+                strategyContext.currentVersion, "patch", { allowStableMajor: allowStableMajorForPath(sourcePath) });
+        return strategyGroup.strategy.propagateDependentPatchImpacts(cwd, strategyGroup.packages.map((pkg) => ({
+            ...pkg,
+            nextVersion: pkg.packagePath === sourcePath ? hypotheticalVersion : null,
+        })));
+    };
+    const isPublishable = (packagePath) => {
+        const strategy = strategyByPath.get(packagePath);
+        const strategyContext = strategyContextByPath.get(packagePath);
+        if (!strategy?.isPublishable || !strategyContext) {
+            return true;
+        }
+        // Abstaining counts as publishable: the enforcement below should only be
+        // skipped on a positive signal that nothing reaches a registry.
+        return strategy.isPublishable(cwd, strategyContext) !== false;
+    };
+    // Forward dependency edges, inverted from the reverse-edge lookup above.
+    // Whether one package records a requirement on another is a property of the
+    // manifests, not of the versions in flight, so this is computed once.
+    const dependenciesByPath = new Map();
+    for (const pkgPlan of workingPlans) {
+        for (const dependentPath of findDependents(pkgPlan.path)) {
+            const existing = dependenciesByPath.get(dependentPath);
+            if (existing) {
+                existing.add(pkgPlan.path);
+                continue;
+            }
+            dependenciesByPath.set(dependentPath, new Set([pkgPlan.path]));
+        }
+    }
+    /**
+     * Every package reachable by following dependency edges down from a
+     * publishable package that is currently releasing. Staleness matters
+     * transitively: a release that pulls in a stale grandparent resolves against
+     * the stale published copy just as readily as a direct dependency does.
+     */
+    const collectReleasingDependencyClosure = () => {
+        const reachable = new Set();
+        const queue = workingPlans
+            .filter((pkgPlan) => pkgPlan.nextVersion && isPublishable(pkgPlan.path))
+            .map((pkgPlan) => pkgPlan.path);
+        while (queue.length > 0) {
+            const currentPath = queue.shift();
+            if (currentPath === undefined) {
+                continue;
+            }
+            for (const dependencyPath of dependenciesByPath.get(currentPath) ?? []) {
+                if (reachable.has(dependencyPath)) {
+                    continue;
+                }
+                reachable.add(dependencyPath);
+                queue.push(dependencyPath);
+            }
+        }
+        return reachable;
+    };
+    // Both rules below can enable each other: forcing a bump creates a dependent
+    // whose requirement must be rewritten, and rewriting a dependent can in turn
+    // expose a stale dependency a further level up. Iterating to a fixpoint
+    // avoids having to order them, and terminates because a package can only
+    // ever move from not-releasing to releasing.
+    for (let iteration = 0; iteration <= workingPlans.length; iteration += 1) {
+        let changed = false;
+        // Rule 1: a package whose recorded requirement on a releasing sibling
+        // would change must release too, or the rewritten requirement ships in the
+        // release commit without a version to publish it under.
+        for (const strategyGroup of strategyPackagesByName.values()) {
+            const impacted = strategyGroup.strategy.propagateDependentPatchImpacts?.(cwd, strategyGroup.packages) ?? [];
+            for (const impactedPath of impacted) {
+                const target = workingPlanByPath.get(impactedPath);
+                if (!target || target.nextVersion) {
+                    continue;
+                }
+                forcePatchBump(target, "dependency-propagation");
+                changed = true;
+            }
+        }
+        // Rule 2: a package that changed since its own last release but produced
+        // no bump would leave a releasing dependent pointing at a stale published
+        // copy. Commit type is deliberately not consulted — the exposure comes
+        // from the change existing, not from how it was labeled.
+        const reachableDependencies = collectReleasingDependencyClosure();
+        for (const candidate of workingPlans) {
+            if (candidate.nextVersion || candidate.commits.length === 0) {
+                continue;
+            }
+            if (!reachableDependencies.has(candidate.path)) {
+                continue;
+            }
+            if (!isPublishable(candidate.path)) {
+                continue;
+            }
+            forcePatchBump(candidate, "stale-dependency");
+            changed = true;
+        }
+        if (!changed) {
+            break;
+        }
+    }
+    const packageNextVersionByPath = {};
+    for (const pkgPlan of workingPlans) {
+        if (pkgPlan.nextVersion) {
+            packageNextVersionByPath[pkgPlan.path] = pkgPlan.nextVersion;
         }
     }
-    const impactedPaths = new Set();
     const dependencySourcePathsByPackage = new Map();
     const addDependencySourcePath = (targetPath, sourcePath) => {
         if (targetPath === sourcePath) {
@@ -164,48 +320,30 @@ export function createReleasePlan(cwd = process.cwd()) {
         }
         dependencySourcePathsByPackage.set(targetPath, new Set([sourcePath]));
     };
+    // Attribute each dependent's requirement rewrite to the specific sources
+    // driving it, using the settled version set so chained bumps are credited.
     for (const strategyGroup of strategyPackagesByName.values()) {
-        const impactedByAll = strategyGroup.strategy.propagateDependentPatchImpacts?.(cwd, strategyGroup.packages) ?? [];
-        for (const pkgPath of impactedByAll) {
-            impactedPaths.add(pkgPath);
-        }
-        const sourcePackages = strategyGroup.packages.filter((pkg) => Boolean(pkg.nextVersion));
-        for (const sourcePackage of sourcePackages) {
-            const scopedImpacts = strategyGroup.strategy.propagateDependentPatchImpacts?.(cwd, strategyGroup.packages.map((pkg) => ({
-                ...pkg,
-                nextVersion: pkg.packagePath === sourcePackage.packagePath
-                    ? sourcePackage.nextVersion
-                    : null,
-            }))) ?? [];
-            for (const impactedPath of scopedImpacts) {
+        for (const sourcePackage of strategyGroup.packages) {
+            if (!sourcePackage.nextVersion) {
+                continue;
+            }
+            for (const impactedPath of findDependents(sourcePackage.packagePath)) {
                 addDependencySourcePath(impactedPath, sourcePackage.packagePath);
             }
         }
     }
-    const propagatedPackages = packagePlans.map((pkgPlan) => {
+    const propagatedPackages = workingPlans.map((pkgPlan) => {
         const dependencySourcePaths = [
             ...(dependencySourcePathsByPackage.get(pkgPlan.path) ??
                 new Set()),
         ]
             .filter((sourcePath) => Boolean(packageNextVersionByPath[sourcePath]))
             .sort((a, b) => a.localeCompare(b));
-        if (pkgPlan.nextVersion || !impactedPaths.has(pkgPlan.path)) {
-            if (dependencySourcePaths.length === 0) {
-                return pkgPlan;
-            }
-            return {
-                ...pkgPlan,
-                dependencySourcePaths,
-            };
+        if (dependencySourcePaths.length === 0) {
+            return pkgPlan;
         }
-        const current = packageCurrentVersionByPath[pkgPlan.path] ?? pkgPlan.currentVersion;
         return {
             ...pkgPlan,
-            releaseType: "patch",
-            nextVersion: bumpVersion(current, "patch", {
-                allowStableMajor: allowStableMajorForPath(pkgPlan.path),
-            }),
-            bumpReason: "dependency-propagation",
             dependencySourcePaths,
         };
     });
@@ -217,6 +355,11 @@ export function createReleasePlan(cwd = process.cwd()) {
         }
     }
     const adjustedPackages = propagatedPackages.map((pkgPlan) => {
+        if (pkgPlan.bumpReason === "release-as") {
+            // An explicit override pins this package's version; do not let a
+            // followed source recompute it out from under the requested version.
+            return pkgPlan;
+        }
         const followsSources = followsByPath.get(pkgPlan.path) ?? [];
         const bumpingSources = followsSources
             .map((sourcePath) => propagatedPackages.find((pkg) => pkg.path === sourcePath))
@@ -237,6 +380,7 @@ export function createReleasePlan(cwd = process.cwd()) {
         ].sort((a, b) => a.localeCompare(b));
         const sourceDrove = combinedReleaseType !== ownReleaseType ||
             pkgPlan.bumpReason === "dependency-propagation" ||
+            pkgPlan.bumpReason === "stale-dependency" ||
             pkgPlan.bumpReason === undefined;
         const baseVersion = packageCurrentVersionByPath[pkgPlan.path] ?? pkgPlan.currentVersion;
         const nextVersion = combinedReleaseType
@@ -272,12 +416,19 @@ export function createReleasePlan(cwd = process.cwd()) {
             commits: rootPackagePlan.commits,
         };
     }
+    const rootOverridden = rootPackagePlan.bumpReason === "release-as";
     if (monorepoMode === "fixed") {
-        const fixedType = analyzeParsedCommits(adjustedPackages.flatMap((pkgPlan) => pkgPlan.parsedCommits));
+        const analyzedFixedType = analyzeParsedCommits(adjustedPackages.flatMap((pkgPlan) => pkgPlan.parsedCommits));
         const fixedBaseVersion = rootPackagePlan.currentVersion;
-        const fixedNextVersion = fixedType
-            ? bumpVersion(fixedBaseVersion, fixedType, { allowStableMajor })
-            : null;
+        // A `Release-As:` footer on the shared (root) version pins every package.
+        const fixedType = rootOverridden
+            ? rootPackagePlan.releaseType
+            : analyzedFixedType;
+        const fixedNextVersion = rootOverridden
+            ? rootPackagePlan.nextVersion
+            : analyzedFixedType
+                ? bumpVersion(fixedBaseVersion, analyzedFixedType, { allowStableMajor })
+                : null;
         const adjusted = adjustedPackages.map((pkgPlan) => ({
             ...pkgPlan,
             releaseType: fixedType,
@@ -300,11 +451,20 @@ export function createReleasePlan(cwd = process.cwd()) {
                 .map(({ implicitRoot: _implicitRoot, ...pkgPlan }) => pkgPlan),
         };
     }
-    const overallType = analyzeParsedCommits(adjustedPackages.flatMap((pkgPlan) => pkgPlan.parsedCommits));
+    const analyzedOverallType = analyzeParsedCommits(adjustedPackages.flatMap((pkgPlan) => pkgPlan.parsedCommits));
     const overallBaseVersion = rootPackagePlan.currentVersion;
-    const overallNextVersion = overallType
-        ? bumpVersion(overallBaseVersion, overallType, { allowStableMajor })
-        : null;
+    // A root-level `Release-As:` footer drives the aggregate version too, keeping
+    // the top-level plan consistent with the pinned root package.
+    const overallType = rootOverridden
+        ? rootPackagePlan.releaseType
+        : analyzedOverallType;
+    const overallNextVersion = rootOverridden
+        ? rootPackagePlan.nextVersion
+        : analyzedOverallType
+            ? bumpVersion(overallBaseVersion, analyzedOverallType, {
+                allowStableMajor,
+            })
+            : null;
     return {
         mode: "simple",
         releaseType: overallType,
@@ -320,10 +480,6 @@ export function createReleasePlan(cwd = process.cwd()) {
         packages: visiblePackages.map(({ implicitRoot: _implicitRoot, ...pkgPlan }) => pkgPlan),
     };
 }
-/** @deprecated Use createReleasePlan. */
-export function createSimplePlan(cwd = process.cwd()) {
-    return createReleasePlan(cwd);
-}
 export function resolvePackageDependencies(plan, packagePath) {
     const target = plan.packages?.find((pkg) => pkg.path === packagePath);
     if (!target) {

package/dist/release/pr.d.ts

@@ -1,15 +1,7 @@
 import type { ParsedCommit } from "../git/commits.js";
 import type { VersionaryChangelogFormat, VersionaryConfig } from "../types/config.js";
 import type { VersionaryPluginContext } from "../types/plugins.js";
-import { type ReleasePlan, type SimplePlan } from "./plan.js";
-export declare function getNextReleaseFile(config: VersionaryConfig): string;
-export declare function readNextReleaseHighlights(cwd: string, config: VersionaryConfig): {
-    content: string;
-    filePath: string;
-} | null;
-export declare function consumeNextReleaseFile(cwd: string, filePath: string): {
-    tracked: boolean;
-};
+import { type ReleasePlan } from "./plan.js";
 /**
  * Read the manual-notes ("Unreleased") prose from the top of a changelog file.
  * Returns an empty string when the file is absent or has no notes block.
@@ -17,15 +9,13 @@ export declare function consumeNextReleaseFile(cwd: string, filePath: string): {
 export declare function readChangelogHighlights(cwd: string, changelogFile: string, format: VersionaryChangelogFormat): string;
 export interface ResolvedReleaseHighlights {
     highlights: string;
-    source: "changelog" | "file" | "none";
-    filePath?: string;
+    source: "changelog" | "none";
 }
 /**
- * Resolve release highlights, preferring an editable "Unreleased" section at the
- * top of the changelog. Falls back to the deprecated `NEXT_RELEASE.md` file
- * (emitting a warning) so existing setups keep working.
+ * Resolve release highlights from the editable "Unreleased" section at the top
+ * of the changelog.
  */
-export declare function resolveReleaseHighlights(cwd: string, config: VersionaryConfig, changelogFile: string, format: VersionaryChangelogFormat, logger?: VersionaryPluginContext["logger"]): ResolvedReleaseHighlights;
+export declare function resolveReleaseHighlights(cwd: string, changelogFile: string, format: VersionaryChangelogFormat): ResolvedReleaseHighlights;
 export declare function splitSafeDirtyFiles(files: string[]): {
     ignored: string[];
     blocking: string[];
@@ -42,8 +32,8 @@ export declare function prepareReleasePr(cwd?: string, options?: {
     updated: boolean;
     highlights: string;
 };
-export declare function renderSimpleReviewRequestBody(version: string, previousVersion: string, commits: ParsedCommit[], plan?: SimplePlan | null, cwd?: string, highlights?: string, loadedConfig?: VersionaryConfig): string;
-export declare function openOrUpdateReviewRequest(cwd: string, branch: string, title: string, version: string, previousVersion: string, commits: ParsedCommit[], plan?: SimplePlan | null, options?: {
+export declare function renderSimpleReviewRequestBody(version: string, previousVersion: string, commits: ParsedCommit[], plan?: ReleasePlan | null, cwd?: string, highlights?: string, loadedConfig?: VersionaryConfig): string;
+export declare function openOrUpdateReviewRequest(cwd: string, branch: string, title: string, version: string, previousVersion: string, commits: ParsedCommit[], plan?: ReleasePlan | null, options?: {
     logger?: VersionaryPluginContext["logger"];
     highlights?: string;
 }): Promise<string>;
@@ -54,14 +44,5 @@ export declare function closeStaleReviewRequestIfExists(cwd?: string, options?:
     url?: string;
     number?: number;
 }>;
-/** @deprecated Use prepareReleasePr. */
-export declare function prepareSimpleReleasePr(cwd?: string, options?: {
-    logger?: VersionaryPluginContext["logger"];
-}): ReturnType<typeof prepareReleasePr>;
-/** @deprecated Use openOrUpdateReviewRequest. */
-export declare function openOrUpdateSimpleReviewRequest(cwd: string, branch: string, title: string, version: string, previousVersion: string, commits: ParsedCommit[], plan?: SimplePlan | null, options?: {
-    logger?: VersionaryPluginContext["logger"];
-    highlights?: string;
-}): Promise<string>;
 export declare function pushReleaseBranch(cwd: string, branch: string): void;
 export declare function isReleaseCommitMessage(commitMessage: string): boolean;

package/dist/release/pr.js

@@ -17,38 +17,6 @@ const SAFE_DIRTY_FILES = new Set([
     "npm-shrinkwrap.json",
 ]);
 const VERSIONARY_RELEASE_TRAILER = "Versionary-Release: true";
-export function getNextReleaseFile(config) {
-    return config["next-release-file"] ?? "NEXT_RELEASE.md";
-}
-export function readNextReleaseHighlights(cwd, config) {
-    const filePath = getNextReleaseFile(config);
-    const fullPath = path.join(cwd, filePath);
-    if (!fs.existsSync(fullPath)) {
-        return null;
-    }
-    const content = fs.readFileSync(fullPath, "utf8").trim();
-    return { content, filePath };
-}
-function isTrackedFile(cwd, filePath) {
-    try {
-        execFileSync("git", ["ls-files", "--error-unmatch", "--", filePath], {
-            cwd,
-            stdio: ["ignore", "pipe", "ignore"],
-        });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-export function consumeNextReleaseFile(cwd, filePath) {
-    const tracked = isTrackedFile(cwd, filePath);
-    const fullPath = path.join(cwd, filePath);
-    if (fs.existsSync(fullPath)) {
-        fs.rmSync(fullPath);
-    }
-    return { tracked };
-}
 /**
  * Read the manual-notes ("Unreleased") prose from the top of a changelog file.
  * Returns an empty string when the file is absent or has no notes block.
@@ -62,24 +30,14 @@ export function readChangelogHighlights(cwd, changelogFile, format) {
     return extractUnreleasedNotes(existing, format).highlights;
 }
 /**
- * Resolve release highlights, preferring an editable "Unreleased" section at the
- * top of the changelog. Falls back to the deprecated `NEXT_RELEASE.md` file
- * (emitting a warning) so existing setups keep working.
+ * Resolve release highlights from the editable "Unreleased" section at the top
+ * of the changelog.
  */
-export function resolveReleaseHighlights(cwd, config, changelogFile, format, logger) {
+export function resolveReleaseHighlights(cwd, changelogFile, format) {
     const fromChangelog = readChangelogHighlights(cwd, changelogFile, format);
     if (fromChangelog.length > 0) {
         return { highlights: fromChangelog, source: "changelog" };
     }
-    const fromFile = readNextReleaseHighlights(cwd, config);
-    if (fromFile) {
-        logger?.warn(`${fromFile.filePath} is deprecated; add release notes under an "Unreleased" heading at the top of ${changelogFile} instead.`);
-        return {
-            highlights: fromFile.content,
-            source: "file",
-            filePath: fromFile.filePath,
-        };
-    }
     return { highlights: "", source: "none" };
 }
 function listTrackedDirtyFiles(cwd) {
@@ -297,20 +255,11 @@ export function prepareReleasePr(cwd = process.cwd(), options = {}) {
     }
     const updatedArtifactFiles = applyConfiguredArtifactRules(cwd, loaded.config, plan);
     const packageReleaseMetadata = buildPackageReleaseMetadata(cwd, plan, loaded.config);
-    const highlightsResult = resolveReleaseHighlights(cwd, loaded.config, plan.changelogFile, plan.changelogFormat, options.logger);
+    const highlightsResult = resolveReleaseHighlights(cwd, plan.changelogFile, plan.changelogFormat);
     const highlights = highlightsResult.highlights;
     const section = renderReleasePlanChangelog(plan, { highlights, cwd });
     prependChangelog(cwd, plan.changelogFile, section, plan.changelogFormat);
     const updatedChangelogFiles = [plan.changelogFile];
-    let consumedHighlightsPath = null;
-    // The changelog "Unreleased" block is stripped in-place by prependChangelog;
-    // only the legacy side file needs explicit consumption and staging.
-    if (highlightsResult.source === "file" && highlightsResult.filePath) {
-        const { tracked } = consumeNextReleaseFile(cwd, highlightsResult.filePath);
-        if (tracked) {
-            consumedHighlightsPath = highlightsResult.filePath;
-        }
-    }
     for (const packagePlan of plan.packages ?? []) {
         if (!packagePlan.nextVersion || packagePlan.path === ".") {
             continue;
@@ -357,7 +306,6 @@ export function prepareReleasePr(cwd = process.cwd(), options = {}) {
             ...updatedVersionFiles,
             ...updatedArtifactFiles,
             ...updatedChangelogFiles,
-            ...(consumedHighlightsPath ? [consumedHighlightsPath] : []),
         ]),
     ];
     execFileSync("git", ["add", ...filesToAdd], {
@@ -497,14 +445,6 @@ export async function closeStaleReviewRequestIfExists(cwd = process.cwd(), optio
     }
     return result;
 }
-/** @deprecated Use prepareReleasePr. */
-export function prepareSimpleReleasePr(cwd = process.cwd(), options = {}) {
-    return prepareReleasePr(cwd, options);
-}
-/** @deprecated Use openOrUpdateReviewRequest. */
-export async function openOrUpdateSimpleReviewRequest(cwd, branch, title, version, previousVersion, commits, plan = null, options = {}) {
-    return openOrUpdateReviewRequest(cwd, branch, title, version, previousVersion, commits, plan, options);
-}
 export function pushReleaseBranch(cwd, branch) {
     execFileSync("git", ["push", "--force-with-lease", "origin", branch], {
         cwd,

package/dist/release/release-as.d.ts

@@ -0,0 +1,29 @@
+import type { ParsedCommit } from "../git/commits.js";
+import { type ReleaseType } from "./semver.js";
+/**
+ * Footer token (case-insensitive) that requests an explicit next version, e.g.
+ *
+ *   chore: graduate to stable release
+ *
+ *   Release-As: 1.0.0
+ *
+ * The override forces a release with the requested version even when the
+ * conventional-commit analysis alone would produce no bump.
+ */
+export declare const RELEASE_AS_FOOTER_TOKEN = "release-as";
+export interface ReleaseAsOverride {
+    /** The requested target version (leading `v` stripped, validated SemVer). */
+    version: string;
+    /** Hash of the commit carrying the winning footer. */
+    sourceHash: string;
+}
+/**
+ * Scan a release window for a `Release-As:` footer override.
+ *
+ * Returns the explicit target version, or `null` when no footer is present.
+ * Throws on an invalid version, a downgrade or no-op relative to
+ * `currentVersion`, or conflicting override versions within the window.
+ */
+export declare function resolveReleaseAsOverride(commits: ParsedCommit[], currentVersion: string): ReleaseAsOverride | null;
+/** Derive the semantic release level implied by moving `from` -> `to`. */
+export declare function releaseTypeBetween(from: string, to: string): ReleaseType;

package/dist/release/release-as.js

@@ -0,0 +1,70 @@
+import { compareVersions, isValidVersion, parseVersion, } from "./semver.js";
+/**
+ * Footer token (case-insensitive) that requests an explicit next version, e.g.
+ *
+ *   chore: graduate to stable release
+ *
+ *   Release-As: 1.0.0
+ *
+ * The override forces a release with the requested version even when the
+ * conventional-commit analysis alone would produce no bump.
+ */
+export const RELEASE_AS_FOOTER_TOKEN = "release-as";
+function normalizeToken(token) {
+    return token.trim().toLowerCase();
+}
+/**
+ * Scan a release window for a `Release-As:` footer override.
+ *
+ * Returns the explicit target version, or `null` when no footer is present.
+ * Throws on an invalid version, a downgrade or no-op relative to
+ * `currentVersion`, or conflicting override versions within the window.
+ */
+export function resolveReleaseAsOverride(commits, currentVersion) {
+    const overrides = [];
+    for (const commit of commits) {
+        for (const footer of commit.footers) {
+            if (normalizeToken(footer.token) !== RELEASE_AS_FOOTER_TOKEN) {
+                continue;
+            }
+            const raw = footer.value.trim().replace(/^v/u, "");
+            if (!isValidVersion(raw)) {
+                throw new Error(`Invalid \`Release-As\` footer in commit ${commit.hash}: ` +
+                    `"${footer.value}" is not a valid SemVer version.`);
+            }
+            overrides.push({ version: raw, sourceHash: commit.hash });
+        }
+    }
+    if (overrides.length === 0) {
+        return null;
+    }
+    const distinct = [...new Set(overrides.map((override) => override.version))];
+    if (distinct.length > 1) {
+        throw new Error(`Conflicting \`Release-As\` footers in release window: ${distinct
+            .map((version) => `"${version}"`)
+            .join(", ")}. Only one target version may be requested.`);
+    }
+    // All requested versions are identical here; the last footer wins.
+    const override = overrides[overrides.length - 1];
+    if (compareVersions(override.version, currentVersion) <= 0) {
+        throw new Error(`\`Release-As\` footer requests ${override.version}, which is not ` +
+            `greater than the current version ${currentVersion}. Downgrades and ` +
+            `no-op releases are not allowed.`);
+    }
+    return override;
+}
+/** Derive the semantic release level implied by moving `from` -> `to`. */
+export function releaseTypeBetween(from, to) {
+    const before = parseVersion(from);
+    const after = parseVersion(to);
+    if (after.major !== before.major) {
+        return "major";
+    }
+    if (after.minor !== before.minor) {
+        return "minor";
+    }
+    if (after.patch !== before.patch) {
+        return "patch";
+    }
+    return null;
+}

package/dist/release/release.d.ts

@@ -30,11 +30,3 @@ export interface RunReleaseOptions {
     "dry-run"?: boolean;
 }
 export declare function runReleaseDetailed(cwd?: string, options?: RunReleaseOptions): Promise<RunReleaseResult>;
-/** @deprecated Use RunReleaseResult. */
-export type SimpleRunReleaseResult = RunReleaseResult;
-/** @deprecated Use RunReleaseOptions. */
-export type RunSimpleReleaseOptions = RunReleaseOptions;
-/** @deprecated Use runRelease. */
-export declare function runSimpleRelease(cwd?: string): Promise<string>;
-/** @deprecated Use runReleaseDetailed. */
-export declare function runSimpleReleaseDetailed(cwd?: string, options?: RunSimpleReleaseOptions): Promise<SimpleRunReleaseResult>;

package/dist/release/release.js

@@ -224,11 +224,3 @@ export async function runReleaseDetailed(cwd = process.cwd(), options = {}) {
         message: `Published releases ${published.join(", ")}`,
     };
 }
-/** @deprecated Use runRelease. */
-export async function runSimpleRelease(cwd = process.cwd()) {
-    return runRelease(cwd);
-}
-/** @deprecated Use runReleaseDetailed. */
-export async function runSimpleReleaseDetailed(cwd = process.cwd(), options = {}) {
-    return runReleaseDetailed(cwd, options);
-}

package/dist/release/state.js

@@ -49,15 +49,7 @@ export function getBaselineStatePath(cwd) {
     if (configured) {
         return path.join(cwd, configured);
     }
-    const preferred = path.join(cwd, ".versionary-manifest.json");
-    if (fs.existsSync(preferred)) {
-        return preferred;
-    }
-    const legacy = path.join(cwd, "versionary.versions.json");
-    if (fs.existsSync(legacy)) {
-        return legacy;
-    }
-    return preferred;
+    return path.join(cwd, ".versionary-manifest.json");
 }
 export function readBaselineSha(cwd = process.cwd()) {
     const filePath = getBaselineStatePath(cwd);
@@ -80,15 +72,14 @@ export function readReleaseTargets(cwd = process.cwd()) {
 }
 // The publish set introduced by the current release PR. `release` consumes this
 // so it only publishes/announces what this PR bumped, not every package in the
-// accumulated baseline. Falls back to the accumulated targets for manifests
-// written before this key existed (legacy compatibility).
+// accumulated baseline.
 export function readPendingReleaseTargets(cwd = process.cwd()) {
     const filePath = getBaselineStatePath(cwd);
     if (!fs.existsSync(filePath)) {
         return [];
     }
     const parsed = parseStateFile(fs.readFileSync(filePath, "utf8"), filePath);
-    return (parsed[PENDING_RELEASE_TARGETS_KEY] ?? parsed[RELEASE_TARGETS_KEY] ?? []);
+    return parsed[PENDING_RELEASE_TARGETS_KEY] ?? [];
 }
 export function writeBaselineSha(cwd = process.cwd(), sha, releaseTargets) {
     const baselineShaValue = sha ??

package/dist/strategy/composite.js

@@ -71,6 +71,17 @@ export function compositeVersionStrategy(strategies) {
             return primary.readPackageName?.(cwd, config) ?? null;
         };
     }
+    if (primary.isPublishable || secondaries.some((s) => s.isPublishable)) {
+        composite.isPublishable = (cwd, pkg) => {
+            // Only strategies that recognize this package's version file have an
+            // opinion; among those, one publishing facet is enough to expose the
+            // package on a registry.
+            const opinions = [primary, ...secondaries]
+                .map((strategy) => strategy.isPublishable?.(cwd, pkg))
+                .filter((opinion) => typeof opinion === "boolean");
+            return opinions.length === 0 ? undefined : opinions.some(Boolean);
+        };
+    }
     if (primary.propagateDependentPatchImpacts ||
         secondaries.some((strategy) => strategy.propagateDependentPatchImpacts)) {
         composite.propagateDependentPatchImpacts = (cwd, packages) => {

package/dist/strategy/node.js

@@ -71,4 +71,19 @@ export const nodeVersionStrategy = {
         }
         return name.trim();
     },
+    isPublishable(cwd, pkg) {
+        if (path.basename(pkg.versionFile) !== "package.json") {
+            return undefined;
+        }
+        const versionPath = path.join(cwd, pkg.versionFile);
+        if (!fs.existsSync(versionPath)) {
+            return true;
+        }
+        try {
+            return readJsonFile(versionPath).private !== true;
+        }
+        catch {
+            return true;
+        }
+    },
 };

package/dist/strategy/rust.js

@@ -253,13 +253,53 @@ function collectRustTargetManifests(cwd, versionFile, includeWorkspaceMembers) {
         : `"${versionFile}" has neither [package] nor [workspace].`;
     throw new Error(`Configured rust target "${versionFile}" is not a Rust crate manifest. ${detail} Either remove the "packages" config so the workspace is auto-discovered, or point a package at a member crate path (e.g. "packages": { "crates/foo": {} }).`);
 }
-function isWorkspaceInheritedVersion(rawVersion) {
+function isWorkspaceInheritedValue(rawVersion) {
     if (!rawVersion || typeof rawVersion !== "object") {
         return false;
     }
     const versionRecord = rawVersion;
     return versionRecord.workspace === true;
 }
+function isPublishValueUnpublishable(rawPublish) {
+    // Cargo treats both `publish = false` and an empty registry list as
+    // "never publish"; a non-empty list still reaches a registry.
+    return (rawPublish === false ||
+        (Array.isArray(rawPublish) && rawPublish.length === 0));
+}
+function readManifestPublishable(cwd, manifest) {
+    const manifestPath = path.join(cwd, manifest);
+    if (!fs.existsSync(manifestPath)) {
+        return true;
+    }
+    const cargoTomlRaw = fs.readFileSync(manifestPath, "utf8");
+    let packageTable;
+    try {
+        ({ packageTable } = parseCargoManifest(manifest, cargoTomlRaw));
+    }
+    catch {
+        return true;
+    }
+    if (!packageTable) {
+        return true;
+    }
+    const rawPublish = packageTable.publish;
+    if (!isWorkspaceInheritedValue(rawPublish)) {
+        return !isPublishValueUnpublishable(rawPublish);
+    }
+    let workspaceManifest;
+    try {
+        workspaceManifest = findWorkspaceManifestForMember(cwd, manifest);
+    }
+    catch {
+        return true;
+    }
+    const workspaceRaw = fs.readFileSync(path.join(cwd, workspaceManifest), "utf8");
+    const { workspaceTable } = parseCargoManifest(workspaceManifest, workspaceRaw);
+    const workspacePackage = workspaceTable?.package && typeof workspaceTable.package === "object"
+        ? workspaceTable.package
+        : null;
+    return !isPublishValueUnpublishable(workspacePackage?.publish);
+}
 function readWorkspacePackageVersion(cargoTomlRaw, versionFile) {
     const { workspaceTable } = parseCargoManifest(versionFile, cargoTomlRaw);
     if (!workspaceTable || typeof workspaceTable !== "object") {
@@ -314,7 +354,7 @@ function readResolvedCargoVersion(cwd, manifest, cargoTomlRaw) {
     if (typeof rawVersion === "string" && rawVersion.trim().length > 0) {
         return rawVersion.trim();
     }
-    if (!isWorkspaceInheritedVersion(rawVersion)) {
+    if (!isWorkspaceInheritedValue(rawVersion)) {
         throw new Error(`${manifest} has invalid [package].version. Expected a non-empty SemVer string or version.workspace = true.`);
     }
     const workspaceManifest = findWorkspaceManifestForMember(cwd, manifest);
@@ -425,7 +465,7 @@ function usesWorkspaceInheritedVersion(cargoTomlRaw, versionFile) {
         return false;
     }
     const rawVersion = packageTable.version;
-    return isWorkspaceInheritedVersion(rawVersion);
+    return isWorkspaceInheritedValue(rawVersion);
 }
 function isDependencySection(section) {
     if (ROOT_DEPENDENCY_SECTIONS.has(section)) {
@@ -733,6 +773,13 @@ export const rustVersionStrategy = {
         }
         return readCargoPackageName(cargoTomlRaw, selectedManifest);
     },
+    isPublishable(cwd, pkg) {
+        const manifest = normalizeSlashPath(pkg.versionFile);
+        if (path.posix.basename(manifest) !== "Cargo.toml") {
+            return undefined;
+        }
+        return readManifestPublishable(cwd, manifest);
+    },
     propagateDependentPatchImpacts(cwd, packages) {
         const manifestToVersion = {};
         const candidateManifests = [];

package/dist/strategy/types.d.ts

@@ -22,6 +22,17 @@ export interface VersionStrategy {
     writeVersion(cwd: string, config: VersionaryConfig, version: string): string[];
     validateProject?(cwd: string, config: VersionaryConfig): string | null;
     readPackageName?(cwd: string, config: VersionaryConfig): string | null;
+    /**
+     * Whether this package is published to a registry. A package that never
+     * reaches a registry cannot leave a stale published copy behind, so release
+     * planning exempts it from published-dependency freshness enforcement.
+     *
+     * Returns `undefined` to abstain, which a strategy must do for a version
+     * file it does not recognize — otherwise, composed with another strategy, it
+     * would outvote the one that actually owns the manifest. Strategies that
+     * omit this hook entirely are assumed to publish everything.
+     */
+    isPublishable?(cwd: string, pkg: StrategyPackagePlanContext): boolean | undefined;
     propagateDependentPatchImpacts?(cwd: string, packages: StrategyPackagePlanContext[]): string[];
     finalizeVersionWrites?(cwd: string, writes: StrategyVersionWriteContext[], context: StrategyFinalizeContext): string[];
 }

package/dist/types/config.d.ts

@@ -5,7 +5,6 @@ export interface VersionaryArtifactRule {
     type: "json" | "toml" | "yaml" | "nix" | "regex";
     path: string;
     "field-path"?: string;
-    jsonpath?: string;
     pattern?: string;
     replacement?: string;
 }
@@ -21,7 +20,7 @@ export interface VersionaryPackage {
 }
 export interface VersionaryConfig {
     version: 1;
-    "review-mode"?: "direct" | "pr" | "review";
+    "review-mode"?: "direct" | "pr";
     "version-file"?: string;
     "changelog-file"?: string;
     "changelog-format"?: VersionaryChangelogFormat;
@@ -29,7 +28,6 @@ export interface VersionaryConfig {
     "release-reference-comments"?: ReleaseReferenceCommentsMode;
     "release-branch"?: string;
     "baseline-file"?: string;
-    "next-release-file"?: string;
     "bootstrap-sha"?: string;
     "monorepo-mode"?: "independent" | "fixed";
     "bump-minor-pre-major"?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "versionary",
-  "version": "0.32.0",
+  "version": "1.0.0",
   "description": "Automatic release framework based on conventional commits and semantic versioning",
   "keywords": [
     "releasing",
@@ -36,7 +36,7 @@
   "devDependencies": {
     "@types/node": "^26.0.1",
     "tsx": "^4.20.6",
-    "typescript": "^6.0.3",
+    "typescript": "^7.0.2",
     "vite": "^8.0.0",
     "vitepress": "^1.6.4",
     "vitest": "^4.1.4"