Bump targets

No package.json? VerBump reads the current version from your latest matching git tag. Point --source at another manifest, or keep any JSON / TOML / YAML / text file in lock-step with the tag via --bump.

Non-Node repos

Rust, Python, Go, anything SemVer works out of the box. If there is no version file, VerBump reads the current version from your latest matching git tag, runs the same Conventional-Commit suggestion machinery, and cuts a CHANGELOG and tag release (skipping the commit when there is nothing to commit). Keep a JSON manifest like composer.json? Point --source at it (or set SOURCE_FILE in .verbumprc) and it becomes both the version source and the file that gets bumped.

Bumping stack-specific files

Keep the version in a pyproject.toml, a Go const, a Helm Chart.yaml, or any text file in lock-step with the tag via --bump (repeatable), or declare the targets once in .verbumprc as BUMP_FILES:

# Text pattern — no extra tool; rewrites only the matching line.
# Works for a Go const, a Python __version__, a Makefile, a Dockerfile, …
verbump --bump 'main.go:Version = "{{version}}"'
verbump --bump 'src/mypkg/__init__.py:__version__ = "{{version}}"'

# Structured dotted path — JSON via jq (built in), TOML/YAML via the
# jq-based yq suite (tomlq / yq) when installed.
verbump --bump pyproject.toml:@project.version --bump Chart.yaml:@version

Or declare them once (newline-separated) — every run keeps them in sync:

# .verbumprc
BUMP_FILES="main.go:Version = \"{{version}}\"
src/mypkg/__init__.py:__version__ = \"{{version}}\"
pyproject.toml:@project.version
Chart.yaml:@version"

A bare --bump <file> bumps the file's top-level .version (JSON/TOML/YAML). @<path> targets any dotted key, including a nested one that the JSON .version default can't reach. A {{version}} text pattern covers everything else with no dependency. Same-version and missing files are skipped with a notice, and every change is staged and listed in the bump commit.

npm lock file

One bump target is implicit: when the version source is package.json (the default) and a package-lock.json sits beside it, the release bumps the lock file too. Matching npm version, this companion bump rewrites the lock's top-level .version and, when present, the root .packages[""].version entry — via jq alone, so npm is never invoked and the git + jq dependency contract holds. The lock file lands in the same bump commit as every other target, so there is nothing to declare — leave package-lock.json out of --bump and --file.

The companion bump fires only when the version source is actually package.json — a --source composer.json run never touches a stray lock file. Like any bump target it appears in --dry-run output, and the release preview records it as its own entry ("role": "lock") reporting the lock's real current version, which can differ from package.json when the two have drifted.