Version packages

@varlock/bumpy@1.17.0

Author: bumpy-bot

.bumpy/cwd-flag.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 1.17.0
+
+<sub>2026-06-25</sub>
+
+- [#138](https://github.com/dmno-dev/bumpy/pull/138) _(minor)_
+  Added a global `--cwd <dir>` flag that runs bumpy as if it were started in `<dir>`. This makes the `pull_request_target` PR-check workflow safe against a previously-undocumented attack: a fork PR could commit a `bunfig.toml`/`.npmrc` that redirected where `bunx @varlock/bumpy` itself was fetched from (swapping in a malicious package at the pinned version). The recommended workflow now fetches and runs bumpy from a trusted base checkout and points it at the untrusted PR tree with `--cwd ./pr`, so package-manager config in the PR can no longer influence how bumpy is obtained.
+
 ## 1.16.1
 
 <sub>2026-06-25</sub>

packages/bumpy/CHANGELOG.md

@@ -1,6 +1,6 @@
 {
   "name": "@varlock/bumpy",
-  "version": "1.16.1",
+  "version": "1.17.0",
   "description": "Modern monorepo versioning and changelog tool",
   "keywords": [
     "bump",