Add cascadeFrom config and simplify cascade API

[theoephraim]

Summary

• Adds consumer-side cascadeFrom as the complement to cascadeTo, allowing packages to declare cascade relationships from either direction
• Both cascadeTo and cascadeFrom now support an array shorthand with sensible defaults (trigger: "patch", bumpAs: "match") alongside the object form for custom rules
• Both always apply regardless of the updateInternalDependencies setting

This solves the case where a package bundles a devDependency (e.g., astro-integration bundling vite-integration) and needs to re-release when that dependency is bumped — previously impossible with the default updateInternalDependencies: "out-of-range" setting.

Usage

// Simple — array of package names/globs
{ "cascadeFrom": ["@varlock/vite-integration"] }

// With custom rules
{ "cascadeFrom": { "@varlock/vite-integration": { "trigger": "minor", "bumpAs": "patch" } } }

Test plan

• 6 new tests for cascadeFrom (array shorthand, match default, trigger threshold, globs, proactive mode, coexistence with cascadeTo)
• All 218 existing tests pass
• Type check passes

[github-actions]

The changes in this PR will be included in the next version bump.

Minor releases

• @varlock/bumpy 1.7.1 → 1.8.0

Bump files in this PR

• cascade-from.md (view diff) (edit)

Click here if you want to add another bump file to this PR

---

This comment is maintained by bumpy.