Varlock Releases Bumpy: A File-Based Versioning Alternative to Changesets

The team behind Varlock launched Bumpy, an open-source, file-based version management and changelog tool designed for monorepos, as reported in InfoQ's report. First unveiled in April 2026 via a Show HN post by creator Theo Ephraim, the project is distributed under the @varlock/bumpy package on npm. Bumpy positions itself as an alternative and successor to changesets, claiming to address more than 120 open issues found in its predecessor while retaining a familiar pull request review workflow.

This report examines Bumpy's architectural model, package protocol capabilities, command-line tool integrations, and operational differences relative to changesets and semantic-release. The tool targets monorepo maintainers, platform engineers, and library authors who coordinate multi-package release schedules across package managers. Teams managing polyglot targets such as container images, editor plugins, and multi-registry JavaScript packages can review how Bumpy structures version propagation, continuous integration runs, and automated bump generation.

What Varlock Bumpy shipped

Varlock Bumpy ships an MIT-licensed, TypeScript-built utility designed around a file-based versioning architecture. Maintainers and contributors place markdown bump files into a dedicated .bumpy/ directory inside their repository workspace. Each bump file declares target packages, specifies release severity levels such as patch or minor updates, and includes user-facing changelog copy. These bump files remain visible in standard pull request diffs, allowing reviewers to audit version increments before release branches merge into production lines.

Continuous integration is streamlined through two dedicated operations: bumpy ci check and bumpy ci release. These run directly in GitHub Actions pipelines without requiring third-party action repositories or GitHub App installations. The package also bundles an AI agent skill that inspects git diffs, detects modified workspaces, and runs bumpy add to draft bump files automatically. The skill integrates through the Vercel Labs skills CLI, GitHub CLI, or as a Claude Code plugin.

What changed for builders in Varlock Bumpy

For builders working in modern monorepos, Bumpy adds native support for workspace: and catalog: dependency protocols across Bun, pnpm, npm, and Yarn. Instead of forcing uniform publishing to npm, Bumpy lets engineers configure per-package custom publish scripts. This enables teams to deploy Visual Studio Code extensions, build Docker images, or publish directly to JSR alongside traditional npm registry updates. A configurable three-phase dependency propagation algorithm gives maintainers control over how peer dependency updates cascade through internal package dependency graphs.

With release 1.14, Bumpy introduced branch-based prerelease channels where prerelease version numbers are calculated at publish time rather than written to git history. Relative to semantic-release, Bumpy bridges file-based workflows with automated tooling via the bumpy generate command, which constructs bump files directly from branch commit history. The underlying package ecosystem maintains production deployments for Varlock alongside more than 25 related libraries and official plugins.

How to install or upgrade Varlock Bumpy

Teams adopting Bumpy can install the tool as a development dependency and migrate an existing changesets configuration in two commands. The initialization process automatically detects and converts existing changesets files into Bumpy's file structure:

bun add -d @varlock/bumpy
bunx bumpy init

For repositories standardizing on agent-driven pull requests, developers can register Bumpy's agent skill across their local development environments and coding assistants. The following terminal commands configure the skill, trigger changelog generation, and run continuous integration gates:

gh extension install varlock/gh-bumpy
claude plugin add @varlock/bumpy
bumpy add
bumpy ci check
bumpy ci release

Gotchas and compatibility in Varlock Bumpy

While Bumpy resolves key limitations in older tooling, compatibility constraints remain across certain package manager setups. Teams evaluating migration have flagged open issues regarding catalog detection specifically under Yarn 4.10 environments. Monorepo setups that deviate from standard workspace declarations require auditing to ensure internal dependency links map correctly into Bumpy's graph parser.

In August 2026, Changesets v3 launched as a substantial cleanup release, closing multiple long-standing issues that Bumpy originally set out to solve. Bumpy's official differences documentation acknowledges the v3 cleanup while maintaining that architectural separations remain. Teams with simple npm-only distribution graphs that do not rely on JSR, VS Code extensions, container targets, or runtime prerelease derivation may find the gaps between the two tools narrower than before.

What to watch after Varlock Bumpy

Future milestones for Bumpy center on deepening compatibility across package manager protocol updates and refining automated commit translation. While the core codebase was developed using artificial intelligence with careful developer oversight, its production usage across Varlock's 25 libraries serves as the active testing ground for dependency graph propagation.

Maintainers continue monitoring how Changesets v3 adoption evolves against Bumpy's custom publishing and branch-derived prerelease models. The project maintains public issues tracking package manager updates, catalog syntax expansions, and community pull requests on its GitHub repository, keeping its full documentation and TypeScript source accessible under the MIT open-source license.