@varlock/bumpy 1.9.0 → 1.10.0

package/README.md

@@ -50,7 +50,7 @@ Fixed locale fallback logic in utils.
 
 - **All package managers** - npm, pnpm, yarn, and bun workspaces
 - **Smart dependency propagation** - configurable rules for how version bumps cascade through your dependency graph (see [version propagation docs](https://github.com/dmno-dev/bumpy/blob/main/docs/version-propagation.md))
-- **Pack-then-publish** - by default, publishes to npm (resolving `workspace:` and `catalog:` protocols, with OIDC/provenance support). Supports [npm staged publishing](https://docs.npmjs.com/about-staged-publishes) for 2FA-gated releases. Per-package custom publish commands let you target anything - VSCode extensions, Docker images, JSR, private registries, etc.
+- **Pack-then-publish** - by default, publishes to npm (resolving `workspace:` and `catalog:` protocols, with OIDC/provenance support). Supports [npm staged publishing](https://docs.npmjs.com/staged-publishing) for 2FA-gated releases. Per-package custom publish commands let you target anything - VSCode extensions, Docker images, JSR, private registries, etc.
 - **Flexible package management** - include/exclude any package individually via per-package config, glob patterns, or `privatePackages` setting
 - **Non-interactive CLI** - `bumpy add` works fully non-interactively for CI/CD and AI-assisted development
 - **Aggregated GitHub releases** - optionally create a single consolidated release instead of one per package
@@ -121,7 +121,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-      id-token: write # required for npm trusted publishing (OIDC)
+      id-token: write # required for npm trusted publishing (OIDC) and provenance
     steps:
       - uses: actions/checkout@v6
         with:
@@ -129,7 +129,8 @@ jobs:
       - uses: oven-sh/setup-bun@v2
       - uses: actions/setup-node@v6
         with:
-          node-version: lts/*
+          node-version: latest
+      - run: npm install -g npm@latest # ensure npm >= 11.15.0 for OIDC/staged publishing
       - run: bun install
       - run: bunx @varlock/bumpy ci release
         env:
@@ -137,7 +138,7 @@ jobs:
           BUMPY_GH_TOKEN: ${{ secrets.BUMPY_GH_TOKEN }} # PAT so that version PR triggers CI
 ```
 
-> **Trusted publishing setup:** Configure each package on [npmjs.com](https://docs.npmjs.com/trusted-publishers/) → Package Settings → Trusted Publishers → GitHub Actions. Specify your org/user, repo, and the workflow filename (`bumpy-release.yml`). No `NPM_TOKEN` secret needed. Requires npm >= 11.5.1 - bumpy will warn if your version is too old.
+> **Trusted publishing setup:** Configure each package on [npmjs.com](https://docs.npmjs.com/trusted-publishers/) → Package Settings → Trusted Publishers → GitHub Actions. Specify your org/user, repo, and the workflow filename (`bumpy-release.yml`). No `NPM_TOKEN` secret needed. Enable `provenance` and `npmStaged` in your [publish config](https://github.com/dmno-dev/bumpy/blob/main/docs/configuration.md#staged-publishing) for maximum security.
 
 <details>
 <summary>Alternative: token-based auth (NPM_TOKEN secret)</summary>

package/config-schema.json

@@ -155,28 +155,6 @@
       },
       "additionalProperties": false
     },
-    "aggregateRelease": {
-      "description": "GitHub release creation (requires gh CLI). false = individual release per package, true = single aggregated release, or an object with enabled and optional title (supports {{date}}).",
-      "default": false,
-      "oneOf": [
-        { "type": "boolean" },
-        {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean",
-              "description": "Whether to create an aggregated release"
-            },
-            "title": {
-              "type": "string",
-              "description": "Custom title for the aggregated release (supports {{date}})"
-            }
-          },
-          "required": ["enabled"],
-          "additionalProperties": false
-        }
-      ]
-    },
     "gitUser": {
       "type": "object",
       "description": "Git identity used for CI commits",

package/dist/{add-D3HlRjOy.mjs → add-B_1I_sen.mjs}

@@ -1,11 +1,11 @@
 import { n as log, r as require_picocolors, s as __toESM } from "./logger-BgksGFuf.mjs";
 import { n as exists, t as ensureDir } from "./fs-CBXKZhoU.mjs";
-import { a as loadConfig, o as loadPackageConfig, r as getBumpyDir } from "./config-CDC1Y_ye.mjs";
-import { a as writeBumpFile, o as discoverPackages, r as readBumpFiles, s as discoverWorkspace, t as filterBranchBumpFiles } from "./bump-file-BOqrdkYP.mjs";
-import { r as getChangedFiles } from "./git-CpJqzpp-.mjs";
+import { a as loadConfig, o as loadPackageConfig, r as getBumpyDir } from "./config-D_4GYDJi.mjs";
+import { a as writeBumpFile, o as discoverPackages, r as readBumpFiles, s as discoverWorkspace, t as filterBranchBumpFiles } from "./bump-file-B9DpXK5X.mjs";
+import { r as getChangedFiles } from "./git-JGLQtk-M.mjs";
 import { l as pt, o as gt, r as Ot, s as mt, t as unwrap, u as wt } from "./clack-W95rXis0.mjs";
 import { n as slugify, t as randomName } from "./names-COooXAFg.mjs";
-import { n as findChangedPackages, r as require_picomatch } from "./check-Dc0ts_q3.mjs";
+import { n as findChangedPackages, r as require_picomatch } from "./check-pbyTB4KC.mjs";
 import { relative, resolve } from "node:path";
 import * as readline from "node:readline";
 //#region src/prompts/bump-select.ts

package/dist/{apply-release-plan-CCoCcpdv.mjs → apply-release-plan-CmjqYo0t.mjs}

@@ -1,6 +1,6 @@
 import { a as readJson, c as removeFile, f as writeText, i as listFiles, l as updateJsonFields, n as exists, s as readText, u as updateJsonNestedField } from "./fs-CBXKZhoU.mjs";
-import { r as getBumpyDir } from "./config-CDC1Y_ye.mjs";
-import { a as prependToChangelog, i as loadFormatter, n as generateChangelogEntry } from "./changelog-DrAf-rL6.mjs";
+import { r as getBumpyDir } from "./config-D_4GYDJi.mjs";
+import { a as prependToChangelog, i as loadFormatter, n as generateChangelogEntry } from "./changelog-A-EwWggW.mjs";
 import { resolve } from "node:path";
 //#region src/core/apply-release-plan.ts
 /** Apply the release plan: bump versions, update changelogs, delete bump files */

package/dist/{bump-file-BOqrdkYP.mjs → bump-file-B9DpXK5X.mjs}

@@ -1,5 +1,5 @@
 import { a as readJson, f as writeText, i as listFiles, n as exists, s as readText } from "./fs-CBXKZhoU.mjs";
-import { i as isPackageManaged, o as loadPackageConfig, r as getBumpyDir } from "./config-CDC1Y_ye.mjs";
+import { i as isPackageManaged, o as loadPackageConfig, r as getBumpyDir } from "./config-D_4GYDJi.mjs";
 import { i as jsYaml, n as detectWorkspaces } from "./package-manager-BQPwXwu5.mjs";
 import { s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
 import { relative, resolve } from "node:path";

package/dist/{changelog-DrAf-rL6.mjs → changelog-A-EwWggW.mjs}

@@ -1,5 +1,5 @@
 import { n as log } from "./logger-BgksGFuf.mjs";
-import { c as maxBump, t as BUMP_LEVELS } from "./types-CL2pqN9N.mjs";
+import { c as maxBump, t as BUMP_LEVELS } from "./types-Bkh-igOJ.mjs";
 import { relative, resolve } from "node:path";
 import { realpathSync } from "node:fs";
 //#region src/core/changelog.ts
@@ -45,7 +45,7 @@ const defaultFormatter = (ctx) => {
 const BUILTIN_FORMATTERS = {
 	default: defaultFormatter,
 	github: async () => {
-		const { createGithubFormatter } = await import("./changelog-github-BYqd2jw1.mjs");
+		const { createGithubFormatter } = await import("./changelog-github-CPVrJHyB.mjs");
 		return createGithubFormatter();
 	}
 };
@@ -56,7 +56,7 @@ const BUILTIN_FORMATTERS = {
 async function loadFormatter(changelog, rootDir) {
 	const [name, options] = Array.isArray(changelog) ? changelog : [changelog, {}];
 	if (name === "github") {
-		const { createGithubFormatter } = await import("./changelog-github-BYqd2jw1.mjs");
+		const { createGithubFormatter } = await import("./changelog-github-CPVrJHyB.mjs");
 		return createGithubFormatter(options);
 	}
 	if (typeof name === "string" && BUILTIN_FORMATTERS[name]) {

package/dist/{changelog-github-BYqd2jw1.mjs → changelog-github-CPVrJHyB.mjs}

@@ -1,6 +1,6 @@
-import { c as maxBump } from "./types-CL2pqN9N.mjs";
+import { c as maxBump } from "./types-Bkh-igOJ.mjs";
 import { s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
-import { o as sortBumpFilesByType, r as getBumpTypeForPackage } from "./changelog-DrAf-rL6.mjs";
+import { o as sortBumpFilesByType, r as getBumpTypeForPackage } from "./changelog-A-EwWggW.mjs";
 //#region src/core/changelog-github.ts
 /** Authors filtered from "Thanks" attribution by default (e.g. bots) */
 /** Authors filtered from "Thanks" attribution by default (e.g. AI/automation bots) */

package/dist/{check-Dc0ts_q3.mjs → check-pbyTB4KC.mjs}

@@ -1,7 +1,7 @@
 import { a as __exportAll, i as __commonJSMin, n as log, s as __toESM, t as colorize } from "./logger-BgksGFuf.mjs";
-import { a as loadConfig, o as loadPackageConfig, r as getBumpyDir } from "./config-CDC1Y_ye.mjs";
-import { r as readBumpFiles, s as discoverWorkspace, t as filterBranchBumpFiles } from "./bump-file-BOqrdkYP.mjs";
-import { a as getFileStatuses, r as getChangedFiles } from "./git-CpJqzpp-.mjs";
+import { a as loadConfig, o as loadPackageConfig, r as getBumpyDir } from "./config-D_4GYDJi.mjs";
+import { r as readBumpFiles, s as discoverWorkspace, t as filterBranchBumpFiles } from "./bump-file-B9DpXK5X.mjs";
+import { a as getFileStatuses, r as getChangedFiles } from "./git-JGLQtk-M.mjs";
 import { relative } from "node:path";
 //#region ../../node_modules/.bun/picomatch@4.0.4/node_modules/picomatch/lib/constants.js
 var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {

package/dist/{ci-9tmC3oNF.mjs → ci-DeZ4zHmn.mjs}

@@ -1,12 +1,12 @@
 import { n as log, t as colorize } from "./logger-BgksGFuf.mjs";
-import { a as loadConfig } from "./config-CDC1Y_ye.mjs";
+import { a as loadConfig } from "./config-D_4GYDJi.mjs";
 import { t as detectPackageManager } from "./package-manager-BQPwXwu5.mjs";
-import { i as recoverDeletedBumpFiles, r as readBumpFiles, s as discoverWorkspace, t as filterBranchBumpFiles } from "./bump-file-BOqrdkYP.mjs";
-import { a as DependencyGraph, t as assembleReleasePlan } from "./release-plan-Ck_DlgcK.mjs";
+import { i as recoverDeletedBumpFiles, r as readBumpFiles, s as discoverWorkspace, t as filterBranchBumpFiles } from "./bump-file-B9DpXK5X.mjs";
+import { a as DependencyGraph, t as assembleReleasePlan } from "./release-plan-mK7iGeGq.mjs";
 import { n as runArgs, r as runArgsAsync, s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
-import { d as withGitToken, r as getChangedFiles } from "./git-CpJqzpp-.mjs";
+import { r as getChangedFiles, u as withGitToken } from "./git-JGLQtk-M.mjs";
 import { t as randomName } from "./names-COooXAFg.mjs";
-import { n as findChangedPackages } from "./check-Dc0ts_q3.mjs";
+import { n as findChangedPackages } from "./check-pbyTB4KC.mjs";
 import { t as resolveCommitMessage } from "./commit-message-CSWVKPJ-.mjs";
 import { appendFileSync, mkdirSync, writeFileSync } from "node:fs";
 import { createHash } from "node:crypto";
@@ -26,6 +26,9 @@ async function withPatToken(fn) {
 	process.env.GH_TOKEN = token;
 	try {
 		return await fn();
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : String(err);
+		throw new Error(msg.replaceAll(token, "***"));
 	} finally {
 		if (originalGhToken !== void 0) process.env.GH_TOKEN = originalGhToken;
 		else delete process.env.GH_TOKEN;
@@ -139,23 +142,22 @@ async function ciPlanCommand(rootDir) {
 		throw new Error("Bump file parse errors must be fixed before planning.");
 	}
 	let output;
-	if (bumpFiles.length > 0) {
-		const plan = assembleReleasePlan(bumpFiles, packages, depGraph, config);
-		output = {
-			mode: "version-pr",
-			bumpFiles: plan.bumpFiles.map((bf) => ({
-				id: bf.id,
-				summary: bf.summary,
-				releases: bf.releases.map((r) => ({
-					name: r.name,
-					type: r.type
-				}))
-			})),
-			releases: plan.releases.map((r) => formatPlanRelease(r, packages, config)),
-			packageNames: plan.releases.map((r) => r.name)
-		};
-	} else {
-		const { findUnpublishedPackages } = await import("./publish-BplMRp4-.mjs");
+	const plan = bumpFiles.length > 0 ? assembleReleasePlan(bumpFiles, packages, depGraph, config) : null;
+	if (plan && plan.releases.length > 0) output = {
+		mode: "version-pr",
+		bumpFiles: plan.bumpFiles.map((bf) => ({
+			id: bf.id,
+			summary: bf.summary,
+			releases: bf.releases.map((r) => ({
+				name: r.name,
+				type: r.type
+			}))
+		})),
+		releases: plan.releases.map((r) => formatPlanRelease(r, packages, config)),
+		packageNames: plan.releases.map((r) => r.name)
+	};
+	else {
+		const { findUnpublishedPackages } = await import("./publish-B3D-70sJ.mjs");
 		const unpublished = await findUnpublishedPackages(packages, config);
 		if (unpublished.length > 0) output = {
 			mode: "publish",
@@ -226,7 +228,7 @@ async function ciReleaseCommand(rootDir, opts) {
 	if (bumpFiles.length === 0) {
 		log.info("No pending bump files — checking for unpublished packages...");
 		const recoveredBumpFiles = recoverDeletedBumpFiles(rootDir);
-		const { publishCommand } = await import("./publish-BplMRp4-.mjs");
+		const { publishCommand } = await import("./publish-B3D-70sJ.mjs");
 		await publishCommand(rootDir, {
 			tag: opts.tag,
 			recoveredBumpFiles
@@ -235,7 +237,13 @@ async function ciReleaseCommand(rootDir, opts) {
 	}
 	const plan = assembleReleasePlan(bumpFiles, packages, depGraph, config);
 	if (plan.releases.length === 0) {
-		log.info("Bump files found but no packages would be released.");
+		log.info("Bump files found but no packages would be released — checking for unpublished packages...");
+		const recoveredBumpFiles = recoverDeletedBumpFiles(rootDir);
+		const { publishCommand } = await import("./publish-B3D-70sJ.mjs");
+		await publishCommand(rootDir, {
+			tag: opts.tag,
+			recoveredBumpFiles
+		});
 		return;
 	}
 	if (opts.mode === "auto-publish") await autoPublish(rootDir, config, plan, opts.tag);
@@ -243,7 +251,7 @@ async function ciReleaseCommand(rootDir, opts) {
 }
 async function autoPublish(rootDir, config, plan, tag) {
 	log.step("Running bumpy version...");
-	const { versionCommand } = await import("./version-fTSOVlym.mjs");
+	const { versionCommand } = await import("./version-88KuPbWa.mjs");
 	await versionCommand(rootDir);
 	log.step("Committing version changes...");
 	runArgs([
@@ -272,7 +280,7 @@ async function autoPublish(rootDir, config, plan, tag) {
 		], { cwd: rootDir });
 	}
 	log.step("Running bumpy publish...");
-	const { publishCommand } = await import("./publish-BplMRp4-.mjs");
+	const { publishCommand } = await import("./publish-B3D-70sJ.mjs");
 	await publishCommand(rootDir, { tag });
 }
 /**
@@ -346,7 +354,7 @@ async function createVersionPr(rootDir, plan, config, packageDirs, branchName) {
 		branch
 	], { cwd: rootDir });
 	log.step("Running bumpy version...");
-	const { versionCommand } = await import("./version-fTSOVlym.mjs");
+	const { versionCommand } = await import("./version-88KuPbWa.mjs");
 	await versionCommand(rootDir);
 	runArgs([
 		"git",

package/dist/cli.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { n as log, t as colorize } from "./logger-BgksGFuf.mjs";
-import { n as findRoot } from "./config-CDC1Y_ye.mjs";
+import { n as findRoot } from "./config-D_4GYDJi.mjs";
 //#region src/cli.ts
 const args = process.argv.slice(2);
 const command = args[0];
@@ -31,7 +31,7 @@ async function main() {
 			}
 			case "add": {
 				const rootDir = await findRoot();
-				const { addCommand } = await import("./add-D3HlRjOy.mjs");
+				const { addCommand } = await import("./add-B_1I_sen.mjs");
 				await addCommand(rootDir, {
 					packages: flags.packages,
 					message: flags.message,
@@ -43,7 +43,7 @@ async function main() {
 			}
 			case "status": {
 				const rootDir = await findRoot();
-				const { statusCommand } = await import("./status-CV8wBBiI.mjs");
+				const { statusCommand } = await import("./status-DeMcLxiM.mjs");
 				await statusCommand(rootDir, {
 					json: flags.json === true,
 					packagesOnly: flags.packages === true,
@@ -55,13 +55,13 @@ async function main() {
 			}
 			case "version": {
 				const rootDir = await findRoot();
-				const { versionCommand } = await import("./version-fTSOVlym.mjs");
+				const { versionCommand } = await import("./version-88KuPbWa.mjs");
 				await versionCommand(rootDir, { commit: flags.commit === true });
 				break;
 			}
 			case "generate": {
 				const rootDir = await findRoot();
-				const { generateCommand } = await import("./generate-BgKOXV47.mjs");
+				const { generateCommand } = await import("./generate-BlZIe3aC.mjs");
 				await generateCommand(rootDir, {
 					from: flags.from,
 					dryRun: flags["dry-run"] === true,
@@ -71,7 +71,7 @@ async function main() {
 			}
 			case "check": {
 				const rootDir = await findRoot();
-				const { checkCommand } = await import("./check-Dc0ts_q3.mjs").then((n) => n.t);
+				const { checkCommand } = await import("./check-pbyTB4KC.mjs").then((n) => n.t);
 				const hookValue = flags.hook;
 				if (hookValue && hookValue !== "pre-commit" && hookValue !== "pre-push") {
 					log.error(`Invalid --hook value "${hookValue}". Expected "pre-commit" or "pre-push".`);
@@ -89,17 +89,17 @@ async function main() {
 				const subcommand = args[1];
 				const ciFlags = parseFlags(args.slice(2));
 				if (subcommand === "check") {
-					const { ciCheckCommand } = await import("./ci-9tmC3oNF.mjs");
+					const { ciCheckCommand } = await import("./ci-DeZ4zHmn.mjs");
 					await ciCheckCommand(rootDir, {
 						comment: ciFlags.comment !== void 0 ? ciFlags.comment === true : void 0,
 						strict: ciFlags.strict === true,
 						noFail: ciFlags["no-fail"] === true
 					});
 				} else if (subcommand === "plan") {
-					const { ciPlanCommand } = await import("./ci-9tmC3oNF.mjs");
+					const { ciPlanCommand } = await import("./ci-DeZ4zHmn.mjs");
 					await ciPlanCommand(rootDir);
 				} else if (subcommand === "release") {
-					const { ciReleaseCommand } = await import("./ci-9tmC3oNF.mjs");
+					const { ciReleaseCommand } = await import("./ci-DeZ4zHmn.mjs");
 					await ciReleaseCommand(rootDir, {
 						mode: ciFlags["auto-publish"] === true ? "auto-publish" : "version-pr",
 						tag: ciFlags.tag,
@@ -116,7 +116,7 @@ async function main() {
 			}
 			case "publish": {
 				const rootDir = await findRoot();
-				const { publishCommand } = await import("./publish-BplMRp4-.mjs");
+				const { publishCommand } = await import("./publish-B3D-70sJ.mjs");
 				await publishCommand(rootDir, {
 					dryRun: flags["dry-run"] === true,
 					tag: flags.tag,
@@ -140,7 +140,7 @@ async function main() {
 			}
 			case "--version":
 			case "-v":
-				console.log(`bumpy 1.9.0`);
+				console.log(`bumpy 1.10.0`);
 				break;
 			case "help":
 			case "--help":
@@ -160,7 +160,7 @@ async function main() {
 }
 function printHelp() {
 	console.log(`
-  ${colorize(`🐸 bumpy v1.9.0`, "bold")} - Modern monorepo versioning
+  ${colorize(`🐸 bumpy v1.10.0`, "bold")} - Modern monorepo versioning
 
   Usage: bumpy <command> [options]
 

package/dist/{config-CDC1Y_ye.mjs → config-D_4GYDJi.mjs}

@@ -1,6 +1,6 @@
 import { a as __exportAll } from "./logger-BgksGFuf.mjs";
 import { a as readJson, n as exists, o as readJsonc } from "./fs-CBXKZhoU.mjs";
-import { l as normalizeCascadeConfig, r as DEFAULT_CONFIG } from "./types-CL2pqN9N.mjs";
+import { l as normalizeCascadeConfig, r as DEFAULT_CONFIG } from "./types-Bkh-igOJ.mjs";
 import { resolve } from "node:path";
 //#region src/core/config.ts
 var config_exports = /* @__PURE__ */ __exportAll({

package/dist/{generate-BgKOXV47.mjs → generate-BlZIe3aC.mjs}

@@ -1,9 +1,9 @@
 import { n as log, t as colorize } from "./logger-BgksGFuf.mjs";
 import { t as ensureDir } from "./fs-CBXKZhoU.mjs";
-import { a as loadConfig, r as getBumpyDir } from "./config-CDC1Y_ye.mjs";
-import { a as writeBumpFile, o as discoverPackages } from "./bump-file-BOqrdkYP.mjs";
+import { a as loadConfig, r as getBumpyDir } from "./config-D_4GYDJi.mjs";
+import { a as writeBumpFile, o as discoverPackages } from "./bump-file-B9DpXK5X.mjs";
 import { s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
-import { n as getBranchCommits, o as getFilesChangedInCommit } from "./git-CpJqzpp-.mjs";
+import { n as getBranchCommits, o as getFilesChangedInCommit } from "./git-JGLQtk-M.mjs";
 import { n as slugify, t as randomName } from "./names-COooXAFg.mjs";
 import { relative } from "node:path";
 //#region src/commands/generate.ts

package/dist/{git-CpJqzpp-.mjs → git-JGLQtk-M.mjs}

@@ -241,16 +241,5 @@ function getFileStatuses(dir, opts) {
 	}
 	return statuses;
 }
-/** Get all tags matching a pattern */
-function listTags(pattern, opts) {
-	const result = tryRunArgs([
-		"git",
-		"tag",
-		"-l",
-		pattern
-	], opts);
-	if (!result) return [];
-	return result.split("\n").filter(Boolean);
-}
 //#endregion
-export { getFileStatuses as a, listTags as c, withGitToken as d, getCurrentBranch as i, pushWithTags as l, getBranchCommits as n, getFilesChangedInCommit as o, getChangedFiles as r, hasUncommittedChanges as s, createTag as t, tagExists as u };
+export { getFileStatuses as a, pushWithTags as c, getCurrentBranch as i, tagExists as l, getBranchCommits as n, getFilesChangedInCommit as o, getChangedFiles as r, hasUncommittedChanges as s, createTag as t, withGitToken as u };

package/dist/index.d.mts

@@ -38,10 +38,17 @@ interface PublishConfig {
    * Default: "pack"
    */
   protocolResolution: 'pack' | 'in-place' | 'none';
+  /**
+   * Attach provenance attestation when publishing via npm.
+   * Requires a supported CI environment with OIDC (GitHub Actions, GitLab CI, etc.).
+   * Only works with publishManager "npm".
+   * Default: false
+   */
+  provenance: boolean;
   /**
    * Use npm staged publishing (`npm stage publish`).
    * Stages the publish on npmjs.com, requiring manual 2FA approval before going live.
-   * Only works with publishManager "npm" and requires npm >= 11.5.1.
+   * Only works with publishManager "npm" and requires npm >= 11.15.0.
    * Default: false
    */
   npmStaged: boolean;
@@ -84,16 +91,6 @@ interface BumpyConfig {
   allowCustomCommands: boolean | string[];
   packages: Record<string, PackageConfig>;
   publish: PublishConfig;
-  /**
-   * GitHub release creation (requires `gh` CLI).
-   * false = individual release per package (default)
-   * true = single aggregated release for all packages
-   * { enabled: true, title: "..." } = aggregate with custom title (supports {{date}})
-   */
-  aggregateRelease: boolean | {
-    enabled: boolean;
-    title?: string;
-  };
   /** Git identity used for CI commits. Defaults to bumpy-bot. */
   gitUser: {
     name: string;

package/dist/index.mjs

@@ -1,8 +1,8 @@
-import { a as DEP_TYPES, c as maxBump, i as DEFAULT_PUBLISH_CONFIG, l as normalizeCascadeConfig, n as DEFAULT_BUMP_RULES, o as bumpLevel, r as DEFAULT_CONFIG, s as hasCascade, t as BUMP_LEVELS } from "./types-CL2pqN9N.mjs";
-import { a as loadConfig, n as findRoot, r as getBumpyDir, s as matchGlob } from "./config-CDC1Y_ye.mjs";
-import { a as writeBumpFile, n as parseBumpFile, o as discoverPackages, r as readBumpFiles } from "./bump-file-BOqrdkYP.mjs";
-import { a as DependencyGraph, i as stripProtocol, n as bumpVersion, r as satisfies, t as assembleReleasePlan } from "./release-plan-Ck_DlgcK.mjs";
-import { a as prependToChangelog, i as loadFormatter, n as generateChangelogEntry, t as defaultFormatter } from "./changelog-DrAf-rL6.mjs";
-import { t as applyReleasePlan } from "./apply-release-plan-CCoCcpdv.mjs";
-import { t as publishPackages } from "./publish-pipeline-BGyQsVyw.mjs";
+import { a as DEP_TYPES, c as maxBump, i as DEFAULT_PUBLISH_CONFIG, l as normalizeCascadeConfig, n as DEFAULT_BUMP_RULES, o as bumpLevel, r as DEFAULT_CONFIG, s as hasCascade, t as BUMP_LEVELS } from "./types-Bkh-igOJ.mjs";
+import { a as loadConfig, n as findRoot, r as getBumpyDir, s as matchGlob } from "./config-D_4GYDJi.mjs";
+import { a as writeBumpFile, n as parseBumpFile, o as discoverPackages, r as readBumpFiles } from "./bump-file-B9DpXK5X.mjs";
+import { a as DependencyGraph, i as stripProtocol, n as bumpVersion, r as satisfies, t as assembleReleasePlan } from "./release-plan-mK7iGeGq.mjs";
+import { a as prependToChangelog, i as loadFormatter, n as generateChangelogEntry, t as defaultFormatter } from "./changelog-A-EwWggW.mjs";
+import { t as applyReleasePlan } from "./apply-release-plan-CmjqYo0t.mjs";
+import { t as publishPackages } from "./publish-pipeline-BRnqVylg.mjs";
 export { BUMP_LEVELS, DEFAULT_BUMP_RULES, DEFAULT_CONFIG, DEFAULT_PUBLISH_CONFIG, DEP_TYPES, DependencyGraph, applyReleasePlan, assembleReleasePlan, bumpLevel, bumpVersion, defaultFormatter, discoverPackages, findRoot, generateChangelogEntry, getBumpyDir, hasCascade, loadConfig, loadFormatter, matchGlob, maxBump, normalizeCascadeConfig, parseBumpFile, prependToChangelog, publishPackages, readBumpFiles, satisfies, stripProtocol, writeBumpFile };