Bumply changelog
Back to Bumply10 releases since August 2026 · The app's update feed, checked Oct 26, 2026
1.10Latest
Bumply 1.10
Deciding not to take an update is a decision too, and this release finally treats it as one — alongside a project page you can read at a glance.
- Deferred decisions are findable. Projects holding a decision have their own
filter in the list, and one view gathers every decision you have made across every project. The reason you skipped ESLint 10 is still there in six months.
- The dependency list is now tabs — vulnerabilities, recommended,
outside range, major, needs review, up to date — with counts on each. No more scrolling a sixty-dependency page to find the two rows worth acting on.
- Update history reads one package at a time in a monorepo, instead of
lumping the workspace root and every package together.
- The menu bar shows the whole portfolio: attention, majors, deferred and
current, over the full project list rather than the first five.
- Project details moved into a sidebar beside the work, and each dependency
now reads as its own card.
1.9
Bumply 1.9
A background check that finds something wrong sends one notification, at the moment it happens — and if your Mac was asleep, that was the only telling. Not any more.
- What changed while you were away now waits for you at the top of the project
list. Each notice says what actually changed — settled → vulnerable — rather than repeating what the project card already says.
- A notice leaves when the problem leaves, or when you dismiss it. Fix an
advisory from the terminal and the notice retires itself, unread. Nothing disappears just because you looked at it, and every dismissal undoes with ⌘Z.
- Colour is never the only signal. Each notice names its own severity in
words, and a project Bumply could not read is no longer painted the same red as a live vulnerability.
1.8
Bumply 1.8
Three things the project verdict claimed to know and did not.
- The list and the project page agree about deferrals. If you deferred an
update, the list stops asking about it too. One of them used to say it was handled while the other kept nagging.
- Project checks are remembered. A project you verified yesterday no longer
reads as never verified after a relaunch. The result is kept, not the output.
- Git state appears in the verdict — as a fact, not a failing. Being in the
middle of your own work is not unfinished dependency maintenance.
- Bumply tells you when a project gets worse after a background check, and
stays quiet when it does not.
- The filter row no longer squeezes the counts out of its own buttons, and the sort
control has one arrow instead of two.
New: Bumply now counts how many people use it — a random number generated on your Mac, the version, and which of five actions happened. No project names, no paths, no IP address. Settings → Usage Count turns it off.
1.7
Bumply 1.7
Everything here came from people who used Bumply on real projects and wrote back.
- Defer an update, with the reason. Bumply stops offering a major you have
already looked at and decided against, and remembers why. It comes back when a newer major is released — or immediately if a security advisory affects it.
- A verdict for each project. One line answering the only question dependency
maintenance asks: can I stop now? It can say no, and it names the one thing in the way. An audit that has not run is reported as unchecked, never as clean.
- The project list answers where to start, not which project looks worst. On a
good day it says so: twelve projects, nothing to do.
- Monorepos. Update history names the packages an update touched instead of
showing package.json in a repository with a dozen of them.
1.6
Bumply 1.6
- Licence activation works. The key inside the app was not the one the
licence server signs with, so every activation was refused. If you bought Bumply and could not activate it, update and try again — nothing needs repurchasing.
1.5
Bumply 1.5
- Restoring a backup works. It never had: Bumply was checking each backup
against the wrong identifier and refusing to read files that were perfectly intact. Backups taken by earlier versions are repaired by this release and can be restored without repeating anything. Reported by Julius on launch day.
- The update notice in the Projects header now matches the buttons beside it.
1.4
Bumply 1.4
- Bumply tells you when there is a new version, in the Projects header
rather than only in a prompt that is easy to dismiss by reflex. It checks when it opens, and the notice stays until you take it.
- Settings now reports what the last check found, instead of only offering a
button.
- Settings and About carried two header treatments at once and faded differently
from the rest of the app. All four pages now match.
1.3
Bumply 1.3
- Blocked updates can now get past themselves. When npm refuses because a
dependency is holding the update back, Bumply names it, shows the command, and offers to move it — then re-checks on its own.
- Update History. Every update Bumply performs keeps the previous
package.json and lockfile. The button on a project now lists what changed and when, opens the backup in Finder, and can put those two files back days later.
- Backup folders are named after the project and the moment, instead of a code
nobody could match to anything.
1.2
Bumply 1.2
- Updating one dependency no longer blocks the next. Bumply used to ask you
to commit changes it had made itself a moment earlier. It now remembers what it wrote, and only asks when the pending changes are yours.
1.1
Bumply 1.1
- Free for three projects. The trial no longer ends in a wall: after seven
days Bumply keeps watching your three oldest projects, and a licence lifts the limit.
- It watches while you work. A menu bar item, a check every six hours, and —
if you turn it on — notifications for new high or critical security advisories.
- Report a bug without leaving the app. About now has a form that shows you
exactly what it will send before it sends it.
- Updates. Bumply can now tell you when there is a new version. This is the
first release that can.
- Around thirty fixes from an audit of the whole app, including npm updates that
ran project scripts while the confirmation said they would not.