Update dependency varlock to v1.23.0

[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
varlock (source)	1.2.0 → 1.23.0

---

Release Notes

dmno-dev/varlock (varlock)

v1.23.0

Compare Source

_2026-10-13

• #​1219 (minor)
  Python codegen: @generatePythonEnv now emits a lazily loaded ENV object with a documented property per item, so editors show item descriptions, @docs() links and deprecations on hover where values are read. Env TypedDict fields get docstrings instead of # comments.
• #​1220 (minor)
  The url type now warns on values that only parse because new URL() is permissive: anything not written as scheme://... (like an SSH key fingerprint SHA256:... or user:pass), whitespace or control characters, a missing host, and malformed http/https hosts the parser would otherwise rewrite (https:///example.com, http://0x7f.1, https://a..b). It also warns on protocols other than http/https when allowedProtocols is not set. These become errors in the next major version. New options: allowedProtocols="*" allows any protocol, and allowNoHost=true allows host-less URLs like sqlite:///app.db.
• #​1218 (patch)
  url(allowedDomains=...) now rejects values whose host other URL parsers could read differently (backslashes, whitespace, percent-encoded or non-ASCII hosts, IPv4 shorthand, missing scheme://host), which could let a value pass the allowlist while the app connects elsewhere. Write internationalized hosts in punycode. url(prependHttps=true) now prefixes host:port values like localhost:3000.
• #​1217 (patch)
  Telemetry no longer adds latency to CLI commands. Events still in flight when a command finishes are handed to a detached background process instead of being awaited, so varlock load and varlock/auto-load take the same time with telemetry on or off. The background process runs from the system temp directory, so it never keeps the project directory in use.
• #​1223 (patch)
  Commented-out config items (ex: # API_KEY=prod-value, including multi-line values) are no longer treated as part of the next item's description, so their values no longer leak into generated types or other description output.
• #​1210 (patch) Thanks @​app/pullfrog!
  Report auto-load CLI crashes with their command and original status, and exit with code 1 instead of a native crash code.

v1.22.0

Compare Source

_2026-10-09

• #​1153 (minor) - Add and() and or() resolver functions for combining boolean conditions
• #​1161 (minor)
  varlock/auto-load and the framework integrations now warn when no config items are loaded (no .env files found, or none define items) instead of silently continuing with an empty config. This becomes an error in the next major. Set _VARLOCK_ALLOW_EMPTY_CONFIG=1 to allow an empty config, which also lets varlock load and varlock run succeed with an empty config.
• #​1133 (minor)
  Bundle the icons used by built-in data types, so @generateTsTypes no longer fetches them over the network. Plugins can ship their own icons via plugin.bundledIcons, and plugin data types and resolvers without an icon now use the plugin's icon. Also adds an icons=false option to leave icons out of generated types entirely.
• #​1181 (minor)
  Rename @redactLogs to @redact (the old name still works as a deprecated alias, with a warning) and add @redact={stdout=true} to redact process.stdout/process.stderr writes (and Bun.write to them) in varlock/auto-load and framework integrations, using the same non-TTY rule as varlock run. Opt-in for now; planned to become the default in the next major. Also adds @sensitive={redact=false} to exempt a value that is meant to be printed, and speeds up the partial-match check used by streaming redaction. Fixes revealSensitiveConfig(), which printed its 👁 markers around the value and did not work under Bun.
• #​1049 (minor)
  Add varlock freeze for apps with no framework integration baking env into the build (Elysia, Hono, Fastify, compiled binaries): it resolves every value once at deploy time into an encrypted file that ships inside the release, and with _VARLOCK_USE_FROZEN_ENV=1 set at runtime the app boots from that file with no varlock CLI, .env files, or resolver credentials present. Framework integrations already freeze in build output (ssrInjectMode: 'resolved-env', picked automatically on some platforms), and Cloudflare Workers use varlock-wrangler deploy, so those users need nothing new. See the frozen env guide for details, including @dynamic=boot for values the platform sets per instance.
• #​1155 (patch) Thanks @​timche!
  Fix varlock audit reporting a referenced item as unused when the item referencing it is overridden, either from the process environment or by a higher-priority file
• #​1156 (patch)
  Error output fixes:
  • errors thrown from a root decorator are no longer printed twice
  • a failing exec() no longer dumps a raw stack trace to stdout (which broke load --format json-full); the error now includes the exit code and stderr
  • an invalid static @cache value is reported once
  • a root decorator referencing an invalid item now shows that item's errors
  • json-full item errors no longer include warnings
• #​1160 (patch) - Fix a declared builtin (e.g. VARLOCK_ENV=) resolving empty when the @currentEnv item depends on it
• #​1165 (patch) - Fix varlock scan --install-hook failing in git worktrees, and respect core.hooksPath
• #​1167 (patch)
  Detect Fly.io as a platform (VARLOCK_PLATFORM=Fly.io), and warn when VARLOCK_ENV is used but only guessed preview because the platform reports no environment or branch
• #​1170 (patch)
  Fix varlock proxy shutdown hanging when a client had read a blocked response over a MITM tunnel, or still held an idle CONNECT tunnel open
• #​1169 (patch) Thanks @​JayOfTheKeyboard!
  Fix the native helper failing with EACCES when varlock runs from a directory the current user cannot enter, such as after runuser to a service user from a private home directory. This broke varlock cache clear in the standalone binary.
• #​1172 (patch)
  Build the standalone binary with Bun 1.4.2, fixing spawn failures when varlock runs from a directory the current user cannot enter
• #​1168 (patch)
  varlock proxy: @proxy(path=...) rules are now matched against the canonical request path (dot segments resolved, repeated slashes collapsed, unreserved percent-escapes decoded), and that canonical path is what is sent upstream. Previously a request spelled /v1/charges/../refunds/x did not match a path="/v1/refunds/**" block rule even though the upstream routed it to /v1/refunds/x. Paths that cannot be canonicalized unambiguously (encoded slashes, backslashes, control characters, #, ; path parameters, .. above the root, absolute-form request lines inside a tunnel) are now rejected with a 400. A substituteIn=[path] value that would itself change the path structure (contains a path separator, dot segment, or query marker) is refused instead of routing the request somewhere the rules never evaluated.
• #​1180 (patch)
  varlock run and varlock proxy run no longer print a "command failed" error when the child handles Ctrl+C (or another forwarded signal) and exits non-zero, e.g. 130
• #​1200 (patch) - Fail with a non-zero exit and name the stuck item when a resolver's promise never settles, instead of silently exiting 0
• #​1194 (patch)
  varlock run and varlock proxy run no longer print a failure hint to stdout when the child exits non-zero; the child's exit code is passed through silently. A command that cannot be started is reported on stderr (exit 127 when not found, 126 when not executable)
• #​1195 (patch) - Fail instead of using partial output when a provider CLI is killed by a signal
• #​1196 (patch)
  Cached pinned @plugin packages now load without a registry lookup, so offline loads work after the plugin is cached (e.g. via varlock install-plugin). Registry errors now name the plugin and URL.
• #​1202 (patch)
  Fix redaction of --include-internal values in varlock run, and warn when a sensitive number is injected, since numbers are never redacted
• #​1203 (patch) - varlock telemetry disable no longer sends a usage event or creates an anonymous ID before saving the opt-out

v1.21.1

Compare Source

_2026-09-29

• #​1130 (patch)
  Error when an unquoted config item value looks like a function call but cannot be parsed as one (e.g. an unquoted arg containing a space), instead of silently using the literal text
• #​1135 (patch)
  Run the varlock CLI with Bun when auto-load or an integration is used from a Bun process, so TypeScript local plugins work there
• #​1148 (patch) Thanks @​app/pullfrog! - Avoid Node's DEP0190 warning and support project paths containing spaces when auto-load runs on Windows

v1.21.0

Compare Source

_2026-09-25

• #​1112 (minor)
  uuid type now accepts UUID versions 6-8 (RFC 9562, including UUIDv7) and the MAX UUID, and takes an optional version option (e.g. @type=uuid(version=7)) to require a specific version.

• #​1124 (minor)
  pick/omit on @import() now accept the same selectors as --filter: #tag to import items tagged with @tag() in the imported file, and !selector to exclude matches (e.g. pick=[#frontend, !#internal] or pick=[API_*, !API_SECRET]). Previously a #tag entry silently matched nothing. @setValuesBulk pick/omit gain ! exclusions too; decorator selectors like @sensitive are rejected with a clear error in both.

  New varlock.filter option in package.json: a default --filter for varlock load/run, valid alongside varlock.loadPath, so a package can point at a shared root schema and take just its tagged items without a .env.schema of its own.

• #​1108 (patch)
  Fix an infinite spawn loop when varlock/auto-load is preloaded via bun's bunfig.toml and bun also serves as node (as in bun-only containers): the CLI process spawned by auto-load was preloaded too, and spawned another. The spawned CLI is now tagged with __VARLOCK_CLI_CHILD and a preloaded auto-load inside it skips resolving.

• #​1107 (patch)
  varlock audit no longer tries to lex string, template and regex literals while scanning source files. A quote inside a regex (such as s.replace(/'/g, "")), JSX text or a docstring could throw that lexer off and silently hide every env var reference after it in the same file. The scanner now only skips lines that are entirely comments, and references mentioned inside string literals are reported like any other.

  New @auditIgnoreKeys(KEY, PREFIX_*) root decorator: keys the audit should never report as missing from the schema, for scanner false positives such as a process.env.FOO mentioned inside a string.

• #​1110 (patch)
  Fix duplicate encryption daemons, and the repeated Touch ID / Windows Hello prompts they cause, when many varlock processes start at once (an MCP host launching several stdio servers, a parallel task runner). Switching between projects on different varlock versions now only restarts the daemon when its binary actually differs, so versions that ship the same daemon share one biometric session.

• #​1114 (patch)
  Plugins whose build is split into several files no longer fail with "No active plugin context" when a chunk loads after the plugin has initialized

• #​1109 (patch)
  Auto-load and framework integrations now always run the varlock CLI installed alongside the imported package, and only fall back to a varlock on PATH when there is no local install. Previously a globally installed CLI could win over the local one when an app was started directly with node, so the runtime library and the CLI could be different versions.

• #​1120 (patch)
  Fix duplicate encryption daemons on Windows when many varlock processes start at once, which made each daemon ask for Windows Hello separately.

• #​1121 (patch)
  varlock run now waits for a child's shutdown handler to finish after forwarding SIGTERM or SIGINT. Previously, in published builds, varlock exited right after forwarding the signal and killed the child mid-shutdown (for example on docker stop with varlock run as the container entrypoint). varlock proxy run now handles signals the same way: it forwards them to the child and waits, instead of killing it immediately, and propagates the child's real exit status. The proxy start daemon's shutdown cleanup is no longer cut short by the same exit hook.

v1.20.0

Compare Source

_2026-09-17

• #​1087 (minor)
  regex("pattern", "flags") is now the one way to write a regex, and takes flags as a second argument: matches=regex("^[0-9a-f]{7,40}$", "i"). Passing a pattern as a string still works but is deprecated and produces a warning showing the regex() call to use: a bare /pattern/ string in matches, remap() match values or @auditExtraPatterns, or a plain string in matches. A future major version will stop reading strings as regexes, which also means a pattern taken from another variable (matches=$PATTERN) will no longer work: write the pattern directly. regex() also rejects a /.../-wrapped argument instead of silently matching the slashes.
• #​1086 (patch)
  Skip the process.env type augmentation when another .d.ts (e.g. wrangler's worker-configuration.d.ts) already declares NodeJS.ProcessEnv, which previously caused a TS2320 conflict. Set processEnv=strict on @​generateTsTypes to override.
• #​1097 (patch) - Reject @type=enum with no members as a schema error instead of accepting a type that no value can satisfy
• #​1052 (patch)
  Serialized env blobs (__VARLOCK_ENV) now record the format version and the varlock version that produced them. Nothing reads these yet: they exist so future version skew between the varlock that resolved the env and the one consuming it can be detected.

v1.19.0

Compare Source

_2026-09-12

• #​1054 (minor)
  Check that a value marked sensitive can actually be protected by redaction, which replaces it wherever it appears. Values under 12 characters warn. Values under 3 characters, booleans, numbers, composites with non-string elements, and the @currentEnv item are an error when you wrote @sensitive on the item, and a warning when @defaultSensitive swept it in, so nothing inherited from the default can fail a load. For a number, make it a string to keep leading zeros and precision. Composite values are checked per element, since redaction registers each element on its own. A non-sensitive value that contains a sensitive one now warns. Acknowledge a legitimately short secret with @sensitive={allowShortValue=true}; it does not apply under 3 characters. Also fixes sensitive values that are not strings, and the pre-coercion form of a coerced value, being shown unredacted in CLI output.
• #​1008 (minor)
  Credential proxy: added request transforms, which let the proxy compute a request's credential itself rather than substituting a placeholder. HMAC signing and Basic auth are built in, and plugins can contribute new transformations.
• #​1068 (minor)
  Plugin cache: getOrSet now accepts a TTL callback, so a plugin can set the cache lifetime from the value it just fetched (an STS session, an OAuth token, a lease). Also fixes plugin caching to respect the cache mode set via the @cache root decorator.
• #​1082 (minor) - New domainFromUrl() function to extract the host from a URL, and a new allowIpV6 option on the domain type
• #​1075 (minor) Thanks @​DavideCarvalho!
  varlock audit can now be taught project-specific env access patterns with @auditExtraPatterns(), for code that reads env vars through a wrapper like configService.get('KEY'). Add fileTypes=[tf, yaml] to a call to limit its patterns to those file types, which is also how the scan reaches file types it skips by default, such as Terraform or Helm values. @auditIgnorePaths() and varlock audit --ignore can now exclude one specific directory, written as a path (./apps/docs, ../, ~/, or absolute) instead of only a bare directory name that matches everywhere it appears. A path written without one of those prefixes, or resolving outside the scanned directory, used to silently exclude nothing and is now an error that names the fix. Also fixes the scanner reporting commented-out code inside template literal interpolations (${/* ... */ ...}) as live env references.
• #​1060 (patch) - Find the Varlock CLI next to Bun-compiled workspace executables.
• #​1064 (patch)
  Data type fixes. @type=enum now matches numeric and boolean members against string values from process.env and overrideValues, so LEVEL=2 or FLAG=true from CI satisfies enum(1, 2, 3) / enum(true, false). @type=url matches allowedDomains in full against the URL host instead of as a substring, which previously let example.com pass an allowlist of myexample.com; write two or more hosts as an array (allowedDomains=[a.com, b.com]), since a comma inside a single string now errors and names the array to use. An allowedDomains entry without a port now allows any port, so allowedDomains=[localhost] accepts http://localhost:3000; add a port to pin it. Each entry must be a hostname with an optional port; an empty list, or a scheme, path, or credentials in an entry, now errors instead of silently matching the wrong host or nothing at all. VS Code diagnostics for allowedDomains, allowedProtocols and noTrailingSlash were reporting different results than an actual load, and now match. @env-spec/parser exports autoCoerce so tooling can classify unquoted values exactly as the parser does. @type=url(noTrailingSlash=true) now also catches a trailing slash that is followed by a query string or hash, such as https://example.com/path/?q=1. @type=ip(version=6) accepts IPv4-mapped addresses like ::ffff:192.168.1.1. @type=md5 accepts uppercase hex and normalizes it to lowercase. @type=port rejects non-integers such as 80.5.
• #​1065 (patch)
  A leak detected in ServerResponse.end no longer leaves the HTTP client hanging. The response is finished before the leak error is rethrown (a plaintext 500 if the headers have not gone out yet, otherwise the connection is closed), so a Next.js Pages Router res.json() that would have leaked a sensitive value fails the request instead of stalling the client on a body that never arrives.
• #​1066 (patch)
  @currentEnv=$FLAG can now reference a key brought in by @import, including a partial import that lists the flag in pick=[...]. Previously the flag had to be defined in the same file, which broke monorepo schemas that import a shared DEPLOY_ENV. A missing flag still errors, now naming the import as a way to provide it. An auto-loaded .env value on its own does not satisfy the flag or trigger .env.<env> loading. A @currentEnv declared in an imported file now also carries through a partial import when the flag is included in the filter. Directory imports declared before the import that provides the flag are rejected with an error asking you to reorder.
• #​1072 (patch) - Report loading/parse errors before resolving values, instead of crashing with expected dataType to be set
• #​1079 (patch)
  varlock load/run no longer spawns the native encryption helper unless encrypted values or the disk cache are actually used. Fixes multi-second startup on WSL 2 for projects with no encrypted values.

v1.18.0

Compare Source

_2026-09-01

• #​1038 (minor)
  Behavior change: schema items that resolve to undefined are no longer injected into process.env as empty strings by auto-load, matching varlock run and the documented VAR= semantics (so process.env.MY_VAR ?? 'fallback' works). varlock load --format shell now also skips them. If your code relies on unset vars being "", add # @injectUndefinedAsEmpty to your .env.schema header to restore the old behavior; when set, generated types mark process.env keys as always-present strings (optional enums become "a" | "b" | "").

• #​1045 (minor)
  New domain data type for validating bare domain names (hostnames), with options for wildcards, single-label hostnames, IPv4 values (for HOST-style vars), lowercasing, and regex matching

• #​1043 (minor) Thanks @​app/pullfrog! - Added allowed protocol validation for URL values.

• #​1046 (minor)
  Proxy: a placeholder appearing in a request surface its rule doesn't substitute in (e.g. the body under the default header-only targets) is now skipped (forwarded unsubstituted) and logged as a skipped-placeholder audit event, instead of blocking the request. Blocking still applies to occurrences off the named path/param within a body: or query: target.

  The maxOccurrences option has been removed. Each substituteIn target is now worth one substitution per request, so listing a target is what grants it an occurrence: an API that carries the secret in two places just names both (substituteIn=["header:authorization", "body:signature"]) instead of raising a count. A repeat at the same target still blocks. Setting maxOccurrences is now a schema error that points at the replacement.

• #​1051 (minor)
  Fix "exports is not defined in ES module scope" when using varlockNextConfigPlugin in a next.config.ts file. varlock now ships CJS builds of its runtime entry points (varlock/env, varlock/patch-console, varlock/patch-server-response, varlock/encrypt-env, varlock/exec-sync-varlock) via the require condition, so requiring them from CommonJS works through Next's TypeScript config loader and on Node versions without require(esm) support (below 22.12).

• #​981 (patch) - Fix leak detection missing sensitive values split across response chunks

• #​1035 (patch) Thanks @​app/pullfrog! - Fix encrypt --file crashing when confirming values to encrypt

• #​1042 (patch)
  auto-load and framework integrations no longer pass NODE_OPTIONS to the varlock CLI subprocess, so preloaded modules (e.g. NODE_OPTIONS="-r next-logger") can no longer corrupt its output and crash env loading

• #​1050 (patch) - Fix @currentEnv from an import losing to the --env fallback when loading a directory's own .env.[env] files

• #​1055 (patch)
  Fixes runtime-provided env vars being deleted from process.env when a server boots from the env snapshot baked into the build output (e.g. a Next.js standalone container where the varlock CLI is unavailable). Introduced in 1.17.1, this could take down a service that passes config at boot with docker run -e ....

v1.17.1

Compare Source

_2026-08-25

• #​1020 (patch) - track proxy subcommand usage in telemetry
• #​1020 (patch) - fix telemetry events being dropped when a command exits before the request finishes
• #​987 (patch)
  Fix package.json entry points - remove references to files that were never built and declare import/require conditions explicitly
• #​1023 (patch) - upgrade gunshi to 0.37.1
• #​1023 (patch) - clearer errors for unknown flags, unknown commands, and bad option values
• #​1023 (patch) - track every CLI subcommand automatically and report schema usage as its own event
• #​1025 (patch) - lazy-load CLI command implementations so startup does not parse every command
• #​1029 (patch)
  Injected env blob reuse now detects .env source file edits: auto-load and varlock run re-resolve instead of serving stale values when a source file changed since the blob was created
• #​1021 (patch) - Build with tsdown instead of tsup; published files now use explicit .mjs/.cjs extensions.

v1.17.0

Compare Source

_2026-08-18

• #​1013 (minor)
  printenv: new --template flag renders a string template with resolved values (with optional --escape json), e.g. auth headers JSON for an MCP headersHelper
• #​1006 (minor)
  Native local-encryption helper binaries now ship as per-platform optional dependencies (@​varlock/native-helper-*), so npm installs only download the binaries for your own platform (on Linux this includes the Windows helper, which WSL needs)
• #​1000 (patch)
  Exit cleanly instead of crashing when CLI output is piped into a consumer that closes early (e.g. varlock flatten | head -3)
• #​1004 (patch)
  Ship the Linux local-encryption helper binaries uncompressed. UPX packing caused antivirus false positives (Defender Wacatac.C!ml) during install.
• #​1007 (patch)
  varlock flatten no longer needs to detect a workspace root - any @​import path that resolves on disk is flattened, including in non-JS monorepos
• #​1007 (patch)
  Clearer errors for Windows-style @​import/@​plugin paths, which are not supported (use forward slashes, or a relative/~ path instead of a drive letter)
• #​1015 (patch) - Replace the semver dependency with verkit, a smaller tree-shakeable alternative
• #​1016 (patch)
  Redact sensitive values from Error objects passed to console methods, and fix console redaction of plain objects that could not survive a JSON round-trip (nested errors, circular references, bigints, dates)

v1.16.1

Compare Source

_2026-08-08

• #​986 (patch) Thanks @​jdalton!
  Telemetry now honors the DO_NOT_TRACK environment variable, alongside the existing VARLOCK_TELEMETRY_DISABLED var and config file settings.
• #​984 (patch)
  fix @preventLeak breaking srvx-based servers (TanStack Start, Nitro) by patching the global Response with a proxy instead of a subclass

v1.16.0

Compare Source

_2026-07-31

• #​968 (minor)
  varlock/auto-load and varlock run now reuse an injected __VARLOCK_ENV blob instead of re-resolving, when it was resolved in the same directory. Set _VARLOCK_USE_INJECTED_ENV=1 to always trust an injected blob (e.g. handing env into a sandbox with no .env files), or 0 to always re-resolve.
• #​965 (minor)
  proxy run --url now dials its tunnel through an HTTP proxy (HTTP(S)_PROXY/NO_PROXY), so a sandboxed agent whose only egress is a proxy gateway (e.g. Docker Sandboxes) can reach a broker
• #​969 (patch)
  varlock proxy reload no longer requires the schema to resolve in the requesting shell: the proxy validates the edit in its own context before applying and reports failures back, so a remote broker can be reloaded with a bare provider exec

v1.15.0

Compare Source

_2026-07-31

• #​960 (minor) - Add generateOtp() for generating TOTP 2FA codes
• #​931 (minor) - proxy: --persist-ca keeps a broker's CA across restarts so clients that already trust it keep working
• #​931 (minor)
  Reach the credential proxy from another machine or a remote sandbox, with no external tunnel tool. varlock proxy start / run gain --expose (optionally --expose=<addr>) to bind off-loopback and serve a built-in CONNECT-over-WebSocket tunnel, so a client behind provider HTTP ingress (E2B, Modal, ...) can route through it. Enabling the tunnel mints a per-session data-plane token that clients must present (pin it with VARLOCK_PROXY_TOKEN), while loopback clients stay exempt and the control endpoint stays loopback-only. varlock proxy run --url <wss-url> -- <command> (with the token in VARLOCK_PROXY_TOKEN, or --token) runs the command through a broker running elsewhere: it opens the tunnel, self-wires the env and CA certs from the broker, and only ever holds placeholders. varlock proxy env also gains --full (emit the whole child-view env, not just the wiring) with --proxy-url / --cert-dir to repoint it, for wiring a client manually. New varlock proxy token prints a session's data-plane token, so a minted one can be read back rather than scraped from logs; the startup banner now withholds it unless stdout is a terminal.
• #​955 (patch)
  The install script now verifies the sha256 of the downloaded archive against the release's published checksums.txt, and fails without installing on a mismatch.

v1.14.1

Compare Source

_2026-07-29

• #​939 (patch) - fix stray backtick in local-encryption docs URL shown by varlock init --agent
• #​956 (patch) Thanks @​app/pullfrog! - Apply pick and omit filters to directory imports.

v1.14.0

Compare Source

_2026-07-28

• #​930 (minor)
  New varlock flatten command: collapses the @​import graph into a self-contained directory (rewriting import paths, pinning plugin versions) so a single package can be deployed without the rest of the monorepo, e.g. in Docker builds
• #​934 (minor)
  Proxy: secrets are now substituted into request headers only by default (excluding common forward/log headers like cookie and x-forwarded-), and a placeholder may appear at most once per request. Widen with @​proxy(substituteIn=[...]) using targets like header:authorization, path, query:api_key, or body:client_secret (body always needs a path; use body: for bodies that can't be parsed into one), and raise the cap with maxOccurrences. This prevents an injected secret from being swapped into a request body, query, or unintended header where it could be exfiltrated.
• #​750 (minor)
  Add @dynamic selector to the --filter language (!@dynamic selects static items). Decorator-based filters (@dynamic/@sensitive/@required) now scope resolution and validation to selected items, so e.g. a build-time --filter='!@dynamic' skips runtime-only vars entirely, including their @required checks
• #​750 (minor) - Add static/dynamic config controls and dynamic+public framework/runtime support
• #​933 (patch) - fix varlock audit ignoring @auditIgnore on schema items
• #​930 (patch)
  plugins now work in shell-less/distroless images: tarballs extract natively (no tar/shell dependency), and varlock flatten --vendor-plugins copies plugins into the output for a fully self-contained artifact
• #​924 (patch)
  Reduce published package size: build the proxy cert authority from low-level asn1 packages instead of @​peculiar/x509, and strip bundled third-party source text from release sourcemaps
• #​937 (patch)
  proxy client compatibility fixes: minted MITM certs now include subject/authority key identifiers so strict TLS verifiers (python 3.13+ urllib/httpx defaults) accept them; the injected env now sets NODE_USE_ENV_PROXY=1 so Node's built-in fetch (node 24+) routes through the proxy instead of silently bypassing it, and DENO_CERT so Deno trusts the proxy CA; Proxy-Authorization from clients is stripped instead of forwarded upstream
• #​946 (patch)
  Root decorators (@​initAws, etc) now resolve the full dependency chain of items referenced in their args, instead of only the directly referenced items
• #​947 (patch) - ENV is no longer exported from the package root; import it from varlock/env instead
• #​943 (patch)
  Cache locks left behind by an interrupted run are now reclaimed immediately instead of stalling later runs for several minutes and hiding the real error. varlock cache clear also clears locks.
• #​949 (patch)
  Fix proxy MITM certs that occasionally failed to load: roughly 1 in 512 minted certs got a non-minimal DER serial number, which strict TLS parsers reject

v1.13.0

Compare Source

_2026-07-21

• #​918 (minor)
  Report load failures to error trackers. varlock/auto-load can now throw the load error (instead of exiting silently) so a reporter like Sentry can capture it. Opt in with a globalThis._varlockOnLoadError hook (called with the error and the values that did resolve), or set _VARLOCK_THROW_ON_LOAD_ERROR=1 when a reporter is already initialized. Default behavior is unchanged.
• #​917 (minor)
  Add array and object value types: @type=array(...) and @type=record(...) with per-element validation, native [a, b] / {k=v} literal values, JSON and separator string input, configurable serialization back to process.env, per-element redaction, and typed code generation across languages
• #​908 (patch) - Reject numeric Infinity/-Infinity in number coercion
• #​910 (patch) - Honor falsy schema overrides for builtin vars like VARLOCK_IS_CI
• #​913 (patch) - Scan Buffer chunks in ServerResponse.end for leaks
• #​920 (patch)
  Fix refs in the @cache root decorator value (e.g. @cache=if($USE_CACHE, "memory", "disabled")) silently resolving as undefined
• #​911 (patch)
  Resolve dynamic arguments in forEnv(); a forEnv() argument that resolves to undefined is now an error instead of silently comparing against "undefined"
• #​895 (patch) Thanks @​cturner8!
  install.sh now installs varlock-local-encrypt.exe on WSL so local encryption can use the Windows TPM/Hello backend (pass --skip-win-exe to opt out)
• #​923 (patch) - Fix varlock run OOM when child command is a bare PATH binary like node (shebang probe no longer reads the whole file)
• #​922 (patch) - Add --plain flag to generate-key for piping into platform CLIs

v1.12.0

Compare Source

_2026-07-20

• #​892 (minor) - Add @generateJavaEnv and @generateCsharpEnv loadable env modules (typed Env, loader, sensitive keys)

• #​780 (patch)
  @encryptInjectedEnv is now honored when varlock run / varlock proxy run inject the env blob.

  Previously the setting only applied to the library auto-load path and build-time integrations; the CLI spawn paths injected a plaintext __VARLOCK_ENV blob and merely forwarded a pre-existing key. In blob-only inject mode (--inject blob), the blob is now encrypted with an ephemeral key carried alongside it, so resolved values never sit in plaintext in the child's environment. This is leak resistance (crash reporters, env dumps, logs), not protection from an attacker who can read the full environment.

• #​780 (patch)
  Add varlock proxy: a local credential proxy for AI agents (preview).

  Run an agent (or any untrusted tool) through a local MITM proxy so it only ever sees placeholder secrets: real values are injected at the wire (bound to a verified upstream TLS identity), responses are scrubbed back to placeholders, and every request is policy-checked and audited. Mark a secret with @proxy(domain="api.example.com"); sensitive items are shown to the child as placeholders by default, with @proxy=passthrough / @proxy=omit escape hatches. Route with host/path/method rules (block, approval), set egress with @proxyConfig={egress="strict"}, and hot-reload live policy with varlock proxy reload. Sessions are durable and auditable (varlock proxy status / rules / audit); proxy start runs a daemon with a live request log that other proxy run invocations attach to. Add proxy run --sandbox to run the agent in a sandbox whose only egress is the proxy: a built-in macOS credential + egress jail, or --sandbox=docker (=podman) to run it in a container while your secrets stay on the host. Preview: on its own the proxy is same-uid and raises the bar rather than being a boundary; --sandbox (or a container) is what makes it one. See the proxy guide.

• #​907 (patch)
  Fix nested varlock run: a command-local override (FOO=bar varlock ...) inside a parent varlock run now wins over the parent's injected value again, instead of being clobbered by the re-injected env blob.

v1.11.0

Compare Source

_2026-07-15

• #​873 (minor)
  Add --filter flag to load/run for selecting env vars by key/glob, @sensitive/@required, or tags (new @tag() item decorator). Also add a matching filter= arg to @generate* code-generation decorators, so a single schema can emit multiple generated files scoped to different subsets.

• #​871 (minor)
  Add detection for Railway, AWS Amplify, Google Cloud Run, Deno Deploy, Zeabur, and Firebase App Hosting; detect dev sandboxes (CodeSandbox, StackBlitz, GitHub Codespaces, Gitpod, Replit) with isCI: false; add detectRuntime/detectOs and expose them as VARLOCK_RUNTIME/VARLOCK_OS builtin variables.

  Also fixes several incorrect env var names found during a std-env doc audit: GitHub Actions PR number (was reading a non-existent variable), GitLab MR number (was using the instance-wide ID instead of the IID), Netlify build URL (double https://), Semaphore PR number (Classic-only variable), Azure Pipelines PR number (prefers the GitHub-facing number), and Bitbucket repo owner (deprecated variable). Adds repo extraction for Bitrise.

  A second pass against std-env's actual detection logic found three more real gaps: Vercel and Netlify now report isCI: false when running their local dev servers (vercel dev, netlify dev) instead of always reporting CI; StackBlitz detection now also requires the WebContainer runtime marker (matching std-env) instead of a weak SHELL-only heuristic that could misfire; and detectRuntime's isNode flag now matches std-env's semantics (stays true under Bun/Deno's Node-compat mode).

• #​874 (patch)
  Fix: varlock load --format json-full no longer includes @internal items by default (pass --include-internal to opt in for local debugging). Framework integrations shell out to this exact command to get their injected config, so this closes a leak where an @internal secret-zero credential could reach client/SSR runtime code.

• #​882 (patch)
  Docs: clarify that _VARLOCK_ENV_KEY encrypts the injected env blob (not an encrypted() resolver), and drop the stale plugin count from the package README

• #​884 (patch) - Refuse to write back encrypted values to non-regular source files (FIFO/pipe) with a clear error instead of blocking

v1.10.0

Compare Source

_2026-07-06

• #​849 (minor)
  Generate code for Python, Rust, Go, and PHP with new per-language decorators (@generatePythonEnv, @generateRustEnv, @generateGoEnv, @generatePhpEnv). Each emits a self-contained, idiomatic module — typed coerced values, a loader that parses the injected env, and a SENSITIVE_KEYS constant — so it's usable out of the box. The TypeScript generator moves to @generateTsTypes and gains options to control process.env/import.meta.env augmentation and a monorepo-friendly exposeEnv=local mode. @generateTypes(lang=ts) still works as a deprecated alias. The varlock typegen command is renamed to varlock codegen (with typegen kept as a deprecated alias). Note: @disableProcessEnvInjection now requires a static true/false value — env-dependent values like forEnv(prod) are a schema error, since generated code must not differ per environment.

• #​853 (patch) - Reject unknown or misspelled CLI flags with a did-you-mean suggestion instead of silently ignoring them

• #​861 (patch)
  Runtime leak detection now catches secrets in compressed responses: gzipped responses that fit in a single chunk (i.e. most pages) were never scanned, so browsers — which always send Accept-Encoding: gzip — could receive leaked sensitive values the scanner should have blocked. Brotli and zstd responses are now scanned too, and compressed chunks containing a leak fail closed (the response is killed) instead of passing through.

  Note: since most browser traffic previously bypassed the scanner, an app with an existing undetected leak will start seeing those responses blocked after upgrading — look for DETECTED LEAKED SENSITIVE CONFIG in server logs, which names the offending config key.

• #​861 (patch)
  Runtime fixes: env state is now shared across bundled copies of varlock/env (fixes stale values after env reloads when a bundler duplicates the module, including cleanup of process.env keys removed between reloads), and node:crypto is loaded lazily — with encrypted env blobs decrypting via WebCrypto on edge runtimes that lack it entirely (e.g. Vercel Edge). Minimum supported Node version is now 22.3.

• #​854 (patch)
  Windows local encryption now uses TPM-sealed keys via NCrypt when available; existing DPAPI keys auto-upgrade on the next decrypt.

• #​865 (patch)
  icon fetching during type generation now ignores failed responses, times out after 2s, and doesn't retry failed icons within a run

• #​866 (patch)
  plugin-registered data types can now declare coercedType so generated env modules type their fields correctly (previously they always emitted as strings)

v1.9.0

Compare Source

_2026-06-25

• #​835 (minor) - Add varlock keychain commands to manage macOS Keychain-backed secrets.

• #​830 (patch)
  Improved audit and init env var scanning in monorepos:

  • Scanning no longer descends into child packages — any subdirectory with its own package.json or .env.schema is treated as a separate package and skipped. This fixes spurious results and makes scanning much faster.
  • Pure execution-environment plumbing (PATH, HOME, SHELL, NODE_OPTIONS, npm_*, etc.) is no longer reported as "missing in schema" by audit, nor added to inferred schemas by init. App-meaningful vars like NODE_ENV and CI variables are still reported.

v1.8.0

Compare Source

_2026-06-23

• #​817 (minor) - Add @​internal decorator to mark items used only by varlock (e.g. a secret-zero token) so they are resolved but not injected into your app
• #​818 (minor) - Enrich CLI telemetry with plugin, integration, and schema feature context.
• #​811 (patch) - Stop UPX on Windows native encrypt binary, sign via Azure Artifact Signing, and publish SHA256SUMS for native helpers
• #​812 (patch) - varlock run now forwards termination signals (SIGTERM/SIGINT/SIGHUP/SIGQUIT) to the child process and propagates its exit status faithfully (128+N on signal death), making it safe to use as a container ENTRYPOINT / PID 1
• #​799 (patch) - Update gunshi to 0.35. varlock cache status/clear are now proper subcommands with scoped help and completion, and printenv/explain/reveal/scan/audit now declare their positional arguments so they appear in --help and shell completion.

v1.7.2

Compare Source

_2026-06-19

• #​806 (patch) - Fix typegen leaking keys that exist only in a plain .env (not declared in .env.schema) into generated types. varlock typegen now also reports any such ignored keys.
• #​809 (patch) - Detect circular @​import() between schemas and fail with a clear error inst

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.