chore[notask]: release @qvac/sdk 0.18.2

[opaninakuffo]

What problem does this PR solve?

Bump @qvac/diffusion-cpp from ^0.17.0 to ^0.18.0 for SDK 0.18.2.

How does it solve it?

• Pin @qvac/diffusion-cpp to ^0.18.0 on @qvac/sdk and @qvac/inference.
• Lockstep stamp inference / sdk / bare-sdk / python SDK_VERSION to 0.18.2.

How was it tested?

• packages/bare-sdk check:deps-vs-sdk passes.
• Changelog markdown is prettier-clean.
• Full e2e still to run on the release cut after merge.

[github-actions]

Review Status

Current Status: ❌ PENDING
Approvals so far: none

Pending reviews: Needs 1 Management or Team Lead, and 1 more from Management, Team Lead, or Member.

[github-actions]

License compliance — clean

No new dependency license findings in this PR.

Warn-only (shadow) mode — this check does not block merges yet.

Updated automatically by the canonical license compliance workflow.

NOTICE presence (advisory)

Missing NOTICE (advisory, does not block):

• ./.github/actions/release-merge-guard
• ./docs/website
• ./packages/ggml-coload-smoke
• ./packages/fabric/test/integration
• ./packages/inference-addon-cpp/mobile
• ./packages/sdk/e2e
• ./packages/llm-llamacpp/benchmarks/performance
• ./packages/llm-llamacpp/benchmarks/server
• ./packages/vla-ggml/sim/server
• ./packages/embed-llamacpp/benchmarks/performance
• ./packages/embed-llamacpp/benchmarks/server
• ./packages/asr-ggml/benchmarks/server

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​qvac/​diffusion-cpp@​0.18.0

View full report

[simon-iribarren]

Heads-up: this release broke the SDK Pod Checks job repo-wide (every PR whose checks run after the 09:41 UTC publish, e.g. this run).

Mechanism: @qvac/inference@0.18.2 published with peerOptional @qvac/diffusion-cpp@"^0.18.0", but main's packages/sdk already pins @qvac/diffusion-cpp@"^0.20.0" (and main's in-tree inference already declares ^0.20.0). The check's plain npm install of packages/sdk resolves "@qvac/inference": "^0.18.0" → 0.18.2 → ERESOLVE:

While resolving: @qvac/inference@0.18.2
Found: @qvac/diffusion-cpp@0.20.0
Could not resolve dependency:
peerOptional @qvac/diffusion-cpp@"^0.18.0" from @qvac/inference@0.18.2

One trap worth flagging before fixing: a 0.18.3 cut with main's ^0.20.0-only peer would flip the same ERESOLVE onto released 0.18-line consumers (sdk@0.18.2 pins diffusion ^0.18.0, and its "@qvac/inference": "^0.18.0" floor would pick 0.18.3 up automatically). The range that satisfies both worlds is a dual peer: "^0.18.0 || ^0.20.0".

Proposed fix (prepared, one commit, ready to hand over): @qvac/inference@0.18.3 on this release line with only:

• packages/inference/package.json: version → 0.18.3, peerDependencies["@qvac/diffusion-cpp"] → "^0.18.0 || ^0.20.0" (devDependencies stays ^0.18.0 so this line keeps developing against its own diffusion);
• a CHANGELOG.md entry explaining the widened contract.

Inference-only — no lockstep republish needed, since sdk@0.18.2's ^0.18.0 floor resolves 0.18.3 automatically. Happy to push the branch and open the PR into a release-sdk-0.18.3 branch if you'd like, or take whatever path fits your train — just flagging it needs to land soon, since every SDK-pod PR is red until 0.18.3 (or equivalent) is on npm.