Dependency changelog review

For every bumped package, answer two questions: does our code have to change, and is the bump safe to merge? Reviewer subagents gather the evidence in parallel; you verify what they claim and write the report.

1. Collect the bumps

Base. The branch, commit or PR/MR the user names; otherwise the merge base with the default branch:

git fetch origin
git merge-base HEAD origin/HEAD   # origin/HEAD unset: take the default branch from `git remote show origin`
git diff <base> --name-only

Diff the working tree against <base>: uncommitted changes count, and whatever the default branch gained since the branch was cut stays out. Pass <base> to every reviewer.

What counts as a bump. Diff each changed file of these kinds and list every change as name old → new: