chore[notask]: release sdk + bare-sdk 0.12.3 (bump bare-fetch to ^3.0.1; dev bare-subprocess ^6.1.0)

(cherry picked from commit eff6876)

Author: lauripiisang

packages/bare-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qvac/bare-sdk",
-  "version": "0.12.2",
+  "version": "0.12.3",
   "license": "Apache-2.0",
   "description": "Bare-targeted slim assembly of the QVAC SDK. Consumers install only the addon packages they need and register plugins explicitly. No addon dependencies pulled in by default.",
   "repository": {
@@ -163,7 +163,7 @@
     "@qvac/registry-client": "^0.6.0",
     "bare-abort-controller": "^1.0.0",
     "bare-crypto": "^1.15.0",
-    "bare-fetch": "^2.9.1",
+    "bare-fetch": "^3.0.1",
     "bare-fs": "^4.5.1",
     "bare-net": "^2.3.2",
     "bare-os": "^3.6.2",

packages/sdk/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [0.12.3]
+
+📦 **NPM:** https://www.npmjs.com/package/@qvac/sdk/v/0.12.3
+
+This is a dependency-maintenance patch. `@qvac/sdk` and `@qvac/bare-sdk` adopt `bare-fetch` 3.x and the SDK moves its dev-only `bare-subprocess` to 6.x. There are no source or public API changes.
+
+## Maintenance
+
+Bump bare-fetch to ^3.0.1 (adopt 3.x; public fetch API unchanged). Bump dev bare-subprocess to ^6.1.0.
+
+The bare-fetch 2→3 jump is a transitive-only major: the public fetch API is unchanged. The only 3.x behavior change is 3.0.1 header validation, and every SDK header construction (`new Headers({ 'User-Agent': ... })`, `append('Range', 'bytes=…')`) already builds RFC-valid headers. The bare-subprocess 5→6 bump is dev-only and affects no shipped code.
+
 ## [0.12.2]
 
 📦 **NPM:** https://www.npmjs.com/package/@qvac/sdk/v/0.12.2

packages/sdk/changelog/0.12.3/CHANGELOG.md

@@ -0,0 +1,7 @@
+# Changelog v0.12.3
+
+Release Date: 2026-06-12
+
+## 🔧 Maintenance
+
+- Bump bare-fetch to ^3.0.1 (adopt 3.x; public fetch API unchanged). Bump dev bare-subprocess to ^6.1.0.

packages/sdk/changelog/0.12.3/CHANGELOG_LLM.md

@@ -0,0 +1,11 @@
+# QVAC SDK v0.12.3 Release Notes
+
+📦 **NPM:** https://www.npmjs.com/package/@qvac/sdk/v/0.12.3
+
+This is a dependency-maintenance patch. `@qvac/sdk` and `@qvac/bare-sdk` adopt `bare-fetch` 3.x and the SDK moves its dev-only `bare-subprocess` to 6.x. There are no source or public API changes.
+
+## Maintenance
+
+Bump bare-fetch to ^3.0.1 (adopt 3.x; public fetch API unchanged). Bump dev bare-subprocess to ^6.1.0.
+
+The bare-fetch 2→3 jump is a transitive-only major: the public fetch API is unchanged. The only 3.x behavior change is 3.0.1 header validation, and every SDK header construction (`new Headers({ 'User-Agent': ... })`, `append('Range', 'bytes=…')`) already builds RFC-valid headers. The bare-subprocess 5→6 bump is dev-only and affects no shipped code.

packages/sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qvac/sdk",
-  "version": "0.12.2",
+  "version": "0.12.3",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -225,7 +225,7 @@
     "@qvac/vla-ggml": "^0.3.2",
     "bare-abort-controller": "^1.0.0",
     "bare-crypto": "^1.15.0",
-    "bare-fetch": "^2.9.1",
+    "bare-fetch": "^3.0.1",
     "bare-fs": "^4.5.1",
     "bare-net": "^2.3.2",
     "bare-os": "^3.6.2",
@@ -257,7 +257,7 @@
     "@types/semver": "^7.7.1",
     "@types/tar-stream": "^3.1.4",
     "bare-readline": "^1.2.0",
-    "bare-subprocess": "^5.2.3",
+    "bare-subprocess": "^6.1.0",
     "bare-url": "^2.4.3",
     "brittle": "^4.0.0",
     "chromadb": "^3.0.14",