Replace semver dependency with verkit

[theoephraim]

Replaces the `semver` package (plus `@types/semver`) with verkit, a smaller, zero-dependency, tree-shakeable semver implementation with native ESM and TypeScript support.

Function mapping at the call sites (plugins, install-plugin command, bun version check, flatten):

• `valid` -> `isValid`
• `validRange` -> `normalizeRange` (same semantics: `null` for invalid, `'*'` for empty/star)
• `satisfies` -> `satisfies` (returns false on invalid inputs, same as before)
• `gte` -> `isGreaterOrEqual`

One minor behavior change: verkit does not treat `=1.2.3` as a valid fixed version, so it is now rejected by the fixed-version checks. The raw descriptor was previously used to build npm registry URLs, where `=1.2.3` would have failed anyway.

verkit is ESM-only; the self-contained CJS bundles inline it via `noExternal`, verified in the build output.

[github-actions]

The changes in this PR will be included in the next version bump.

Patch releases

• varlock 1.16.1 → 1.16.2

Bump files in this PR

• semver-to-verkit.md (view diff) (edit)

Click here if you want to add another bump file to this PR

---

This comment is maintained by bumpy.

[github-actions]

📦 Bundle size

✅ shrinks the bundle by 104.8 KB (−2.1%)

Metric	main	This PR	Δ
Total dist	5038.9 KB	4934.1 KB	−104.8 KB (−2.1%)
JS	1725.5 KB	1675.2 KB	−50.3 KB (−2.9%)
Sourcemaps	3236.9 KB	3182.3 KB	−54.5 KB (−1.7%)
Type defs	76.6 KB	76.6 KB	—

dist/ only; native binaries are versioned separately and not counted here.

[pullfrog]

✅ No new issues found.

Reviewed changes across the dependency replacement and all version-sensitive call sites.

• Dependency replacement: Removes the direct semver and @types/semver dependencies and adds verkit@^0.4.0 with a patch changeset.
• Plugin version handling: Maps exact-version validation, range normalization, and installed-version satisfaction checks to the corresponding verkit APIs.
• Runtime comparisons: Moves the Bun minimum-version check and flattening logic to verkit while preserving their existing decisions.
• Packaging: Keeps verkit bundled into Varlock's ESM output and self-contained CJS runtime bundles.

  ^{｜ View workflow run ｜ Using azure/gpt-5.6-sol ｜ 𝕏}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/varlock@1015

commit: 8ff5fb1