🐸 Versioned release

[bumpy-bot]

This PR was created and will be kept in sync by bumpy based on your bump files (in .bumpy/). Merge it when you are ready to release the packages listed below:

Minor releases

@varlock/native-helper-darwin 1.17.1 → 1.18.0 _CHANGELOG.md

@varlock/native-helper-linux-arm64 1.17.1 → 1.18.0 _CHANGELOG.md

@varlock/native-helper-linux-x64 1.17.1 → 1.18.0 _CHANGELOG.md

@varlock/native-helper-win32-x64 1.17.1 → 1.18.0 _CHANGELOG.md

env-spec-language 0.3.3 → 0.4.0 _CHANGELOG.md

• Add completions and diagnostics for the new domain data type (bump file)
• Added allowed protocol validation for URL values. (bump file)

varlock 1.17.1 → 1.18.0 _CHANGELOG.md

• Fix leak detection missing sensitive values split across response chunks (bump file)
• Fix encrypt --file crashing when confirming values to encrypt (bump file)
• auto-load and framework integrations no longer pass NODE_OPTIONS to the varlock CLI subprocess, so preloaded modules (e.g. NODE_OPTIONS="-r next-logger") can no longer corrupt its output and crash env loading (bump file)
• Behavior change: schema items that resolve to undefined are no longer injected into process.env as empty strings by auto-load, matching varlock run and the documented VAR= semantics (so process.env.MY_VAR ?? 'fallback' works). varlock load --format shell now also skips them. If your code relies on unset vars being "", add # @injectUndefinedAsEmpty to your .env.schema header to restore the old behavior; when set, generated types mark process.env keys as always-present strings (optional enums become "a" | "b" | ""). (bump file)
• New domain data type for validating bare domain names (hostnames), with options for wildcards, single-label hostnames, IPv4 values (for HOST-style vars), lowercasing, and regex matching (bump file)
• Added allowed protocol validation for URL values. (bump file)
• Proxy: a placeholder appearing in a request surface its rule doesn't substitute in (e.g. the body under the default header-only targets) is now skipped (forwarded unsubstituted) and logged as a skipped-placeholder audit event, instead of blocking the request. Blocking still applies to occurrences off the named path/param within a body: or query: target. (bump file)
  The maxOccurrences option has been removed. Each substituteIn target is now worth one substitution per request, so listing a target is what grants it an occurrence: an API that carries the secret in two places just names both (substituteIn=["header:authorization", "body:signature"]) instead of raising a count. A repeat at the same target still blocks. Setting maxOccurrences is now a schema error that points at the replacement.
• Fix @currentEnv from an import losing to the --env fallback when loading a directory's own .env.[env] files (bump file)
• Fix "exports is not defined in ES module scope" when using varlockNextConfigPlugin in a next.config.ts file. varlock now ships CJS builds of its runtime entry points (varlock/env, varlock/patch-console, varlock/patch-server-response, varlock/encrypt-env, varlock/exec-sync-varlock) via the require condition, so requiring them from CommonJS works through Next's TypeScript config loader and on Node versions without require(esm) support (below 22.12). (bump file)
• Fixes runtime-provided env vars being deleted from process.env when a server boots from the env snapshot baked into the build output (e.g. a Next.js standalone container where the varlock CLI is unavailable). Introduced in 1.17.1, this could take down a service that passes config at boot with docker run -e .... (bump file)

Patch releases

@varlock/astro-integration 1.4.0 → 1.4.1 (cascade) _CHANGELOG.md

• Version bump via cascade rule

@varlock/cloudflare-integration 1.5.0 → 1.5.1 (cascade) _CHANGELOG.md

• Version bump via cascade rule

@varlock/nextjs-integration 1.2.1 → 1.2.2 _CHANGELOG.md

• Fix "exports is not defined in ES module scope" when using varlockNextConfigPlugin in a next.config.ts file. varlock now ships CJS builds of its runtime entry points (varlock/env, varlock/patch-console, varlock/patch-server-response, varlock/encrypt-env, varlock/exec-sync-varlock) via the require condition, so requiring them from CommonJS works through Next's TypeScript config loader and on Node versions without require(esm) support (below 22.12). (bump file)
• Fixes runtime-provided env vars being deleted from process.env when a server boots from the env snapshot baked into the build output (e.g. a Next.js standalone container where the varlock CLI is unavailable). Introduced in 1.17.1, this could take down a service that passes config at boot with docker run -e .... (bump file)

@varlock/nuxt-integration 0.1.0 → 0.1.1 (cascade) _CHANGELOG.md

• Version bump via cascade rule

@varlock/vite-integration 1.5.0 → 1.5.1 _CHANGELOG.md

• Fixes runtime-provided env vars being deleted from process.env when a server boots from the env snapshot baked into the build output (e.g. a Next.js standalone container where the varlock CLI is unavailable). Introduced in 1.17.1, this could take down a service that passes config at boot with docker run -e .... (bump file)

[pullfrog]

This run croaked 😵

The workflow encountered an error before any progress could be reported. Please check the link below for details.

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ 𝕏}

[github-actions]

📦 Bundle size vs last published release

⚠️ grows the bundle by 242.4 KB (+6.0%)

Metric	v1.17.1 (published)	This release	Δ
Total dist	4049.8 KB	4292.2 KB	+242.4 KB (+6.0%)
JS	1566.7 KB	1645.6 KB	+78.9 KB (+5.0%)
Sourcemaps	2398.6 KB	2549.8 KB	+151.2 KB (+6.3%)
Type defs	84.6 KB	96.8 KB	+12.3 KB (+14.5%)
Other	0.0 KB	0.0 KB	—

dist/ only; native binaries are versioned separately and not counted here.