[bumpy-bot]

This PR was created and will be kept in sync by bumpy based on your bump files (in .bumpy/). Merge it when you are ready to release the packages listed below:

Minor releases

@varlock/native-helper-darwin 1.21.1 → 1.22.0 _CHANGELOG.md

@varlock/native-helper-linux-arm64 1.21.1 → 1.22.0 _CHANGELOG.md

@varlock/native-helper-linux-x64 1.21.1 → 1.22.0 _CHANGELOG.md

@varlock/native-helper-win32-x64 1.21.1 → 1.22.0 _CHANGELOG.md

varlock 1.21.1 → 1.22.0 _CHANGELOG.md

• Fix varlock audit reporting a referenced item as unused when the item referencing it is overridden, either from the process environment or by a higher-priority file (bump file)
• Error output fixes: (bump file)
  • errors thrown from a root decorator are no longer printed twice
  • a failing exec() no longer dumps a raw stack trace to stdout (which broke load --format json-full); the error now includes the exit code and stderr
  • an invalid static @cache value is reported once
  • a root decorator referencing an invalid item now shows that item's errors
  • json-full item errors no longer include warnings
• Add and() and or() resolver functions for combining boolean conditions (bump file)
• Fix a declared builtin (e.g. VARLOCK_ENV=) resolving empty when the @currentEnv item depends on it (bump file)
• Fix varlock scan --install-hook failing in git worktrees, and respect core.hooksPath (bump file)
• Detect Fly.io as a platform (VARLOCK_PLATFORM=Fly.io), and warn when VARLOCK_ENV is used but only guessed preview because the platform reports no environment or branch (bump file)
• Fix varlock proxy shutdown hanging when a client had read a blocked response over a MITM tunnel, or still held an idle CONNECT tunnel open (bump file)
• Fix the native helper failing with EACCES when varlock runs from a directory the current user cannot enter, such as after runuser to a service user from a private home directory. This broke varlock cache clear in the standalone binary. (bump file)
• Build the standalone binary with Bun 1.4.2, fixing spawn failures when varlock runs from a directory the current user cannot enter (bump file)
• varlock proxy: @proxy(path=...) rules are now matched against the canonical request path (dot segments resolved, repeated slashes collapsed, unreserved percent-escapes decoded), and that canonical path is what is sent upstream. Previously a request spelled /v1/charges/../refunds/x did not match a path="/v1/refunds/**" block rule even though the upstream routed it to /v1/refunds/x. Paths that cannot be canonicalized unambiguously (encoded slashes, backslashes, control characters, #, ; path parameters, .. above the root, absolute-form request lines inside a tunnel) are now rejected with a 400. A substituteIn=[path] value that would itself change the path structure (contains a path separator, dot segment, or query marker) is refused instead of routing the request somewhere the rules never evaluated. (bump file)
• varlock/auto-load and the framework integrations now warn when no config items are loaded (no .env files found, or none define items) instead of silently continuing with an empty config. This becomes an error in the next major. Set _VARLOCK_ALLOW_EMPTY_CONFIG=1 to allow an empty config, which also lets varlock load and varlock run succeed with an empty config. (bump file)
• Bundle the icons used by built-in data types, so @generateTsTypes no longer fetches them over the network. Plugins can ship their own icons via plugin.bundledIcons, and plugin data types and resolvers without an icon now use the plugin's icon. Also adds an icons=false option to leave icons out of generated types entirely. (bump file)
• varlock run and varlock proxy run no longer print a "command failed" error when the child handles Ctrl+C (or another forwarded signal) and exits non-zero, e.g. 130 (bump file)
• Fail with a non-zero exit and name the stuck item when a resolver's promise never settles, instead of silently exiting 0 (bump file)
• varlock run and varlock proxy run no longer print a failure hint to stdout when the child exits non-zero; the child's exit code is passed through silently. A command that cannot be started is reported on stderr (exit 127 when not found, 126 when not executable) (bump file)
• Fail instead of using partial output when a provider CLI is killed by a signal (bump file)
• Cached pinned @plugin packages now load without a registry lookup, so offline loads work after the plugin is cached (e.g. via varlock install-plugin). Registry errors now name the plugin and URL. (bump file)
• Fix redaction of --include-internal values in varlock run, and warn when a sensitive number is injected, since numbers are never redacted (bump file)
• varlock telemetry disable no longer sends a usage event or creates an anonymous ID before saving the opt-out (bump file)
• Rename @redactLogs to @redact (the old name still works as a deprecated alias, with a warning) and add @redact={stdout=true} to redact process.stdout/process.stderr writes (and Bun.write to them) in varlock/auto-load and framework integrations, using the same non-TTY rule as varlock run. Opt-in for now; planned to become the default in the next major. Also adds @sensitive={redact=false} to exempt a value that is meant to be printed, and speeds up the partial-match check used by streaming redaction. Fixes revealSensitiveConfig(), which printed its 👁 markers around the value and did not work under Bun. (bump file)
• Add varlock freeze for apps with no framework integration baking env into the build (Elysia, Hono, Fastify, compiled binaries): it resolves every value once at deploy time into an encrypted file that ships inside the release, and with _VARLOCK_USE_FROZEN_ENV=1 set at runtime the app boots from that file with no varlock CLI, .env files, or resolver credentials present. Framework integrations already freeze in build output (ssrInjectMode: 'resolved-env', picked automatically on some platforms), and Cloudflare Workers use varlock-wrangler deploy, so those users need nothing new. See the frozen env guide for details, including @dynamic=boot for values the platform sets per instance. (bump file)

Patch releases

@varlock/1password-plugin 2.0.4 → 2.0.5 _CHANGELOG.md

• Report an invalid or rejected service account token as an error on the item instead of crashing, when using the SDK (bump file)
• Bundle this plugin's icon so generated types include it without a network request. The AWS, Azure, Google Cloud, Doppler, and Infisical icons are now monochrome so they follow the editor theme. (bump file)
• Fail an op() item instead of hanging when the 1Password CLI returns no value for its reference (bump file)
• Fail instead of using partial output when a provider CLI is killed by a signal (bump file)

@varlock/astro-integration 1.4.2 → 1.4.3 (cascade) _CHANGELOG.md

• Version bump via cascade rule

@varlock/aws-secrets-plugin 1.2.4 → 1.2.5 _CHANGELOG.md

• Bundle this plugin's icon so generated types include it without a network request. The AWS, Azure, Google Cloud, Doppler, and Infisical icons are now monochrome so they follow the editor theme. (bump file)

@varlock/aws-sigv4-plugin 0.1.1 → 0.1.2 _CHANGELOG.md

• Bundle this plugin's icon so generated types include it without a network request. The AWS, Azure, Google Cloud, Doppler, and Infisical icons are now monochrome so they follow the editor theme. (bump file)

@varlock/azure-key-vault-plugin 1.3.0 → 1.3.1 _CHANGELOG.md

• Bundle this plugin's icon so generated types include it without a network request. The AWS, Azure, Google Cloud, Doppler, and Infisical icons are now monochrome so they follow the editor theme. (bump file)

@varlock/bitwarden-plugin 2.0.1 → 2.0.2 _CHANGELOG.md

• Bundle this plugin's icon so generated types include it without a network request. The AWS, Azure, Google Cloud, Doppler, and Infisical icons are now monochrome so they follow the editor theme. (bump file)
• Fail instead of using partial output when a provider CLI is killed by a signal (bump file)

@varlock/ci-env-info 0.1.1 → 0.1.2 _CHANGELOG.md

• Detect Fly.io as a platform (VARLOCK_PLATFORM=Fly.io), and warn when VARLOCK_ENV is used but only guessed preview because the platform reports no environment or branch (bump file)

@varlock/cloudflare-integration 1.6.0 → 1.6.1 (cascade) _CHANGELOG.md

• Version bump via cascade rule

@varlock/dashlane-plugin 2.1.1 → 2.1.2 _CHANGELOG.md

• Bundle this plugin's icon so generated types include it without a network request. The AWS, Azure, Google Cloud, Doppler, and Infisical icons are now monochrome so they follow the editor theme. (bump file)

@varlock/doppler-plugin 2.0.1 → 2.0.2 _CHANGELOG.md

• Bundle this plugin's icon so generated types include it without a network request. The AWS, Azure, Google Cloud, Doppler, and Infisical icons are now monochrome so they follow the editor theme. (bump file)

@varlock/google-secret-manager-plugin 1.2.3 → 1.2.4 _CHANGELOG.md

• Fix Workload Identity Federation, which never passed the OIDC token to Google STS. (bump file)
• Bundle this plugin's icon so generated types include it without a network request. The AWS, Azure, Google Cloud, Doppler, and Infisical icons are now monochrome so they follow the editor theme. (bump file)

@varlock/hashicorp-vault-plugin 2.1.1 → 2.1.2 _CHANGELOG.md

• Bundle this plugin's icon so generated types include it without a network request. The AWS, Azure, Google Cloud, Doppler, and Infisical icons are now monochrome so they follow the editor theme. (bump file)

@varlock/infisical-plugin 2.1.2 → 2.1.3 _CHANGELOG.md

• Bundle this plugin's icon so generated types include it without a network request. The AWS, Azure, Google Cloud, Doppler, and Infisical icons are now monochrome so they follow the editor theme. (bump file)

@varlock/keepass-plugin 2.0.3 → 2.0.4 _CHANGELOG.md

• Bundle this plugin's icon so generated types include it without a network request. The AWS, Azure, Google Cloud, Doppler, and Infisical icons are now monochrome so they follow the editor theme. (bump file)
• Fail instead of using partial output when a provider CLI is killed by a signal (bump file)

@varlock/keeper-plugin 2.0.1 → 2.0.2 _CHANGELOG.md

• Bundle this plugin's icon so generated types include it without a network request. The AWS, Azure, Google Cloud, Doppler, and Infisical icons are now monochrome so they follow the editor theme. (bump file)

@varlock/kubernetes-plugin 1.0.1 → 1.0.2 _CHANGELOG.md

• Bundle this plugin's icon so generated types include it without a network request. The AWS, Azure, Google Cloud, Doppler, and Infisical icons are now monochrome so they follow the editor theme. (bump file)

@varlock/nextjs-integration 1.2.3 → 1.2.4 _CHANGELOG.md

• varlock/auto-load and the framework integrations now warn when no config items are loaded (no .env files found, or none define items) instead of silently continuing with an empty config. This becomes an error in the next major. Set _VARLOCK_ALLOW_EMPTY_CONFIG=1 to allow an empty config, which also lets varlock load and varlock run succeed with an empty config. (bump file)
• Leak remediation for built files also redacts values marked @sensitive={redact=false}. (bump file)

@varlock/nuxt-integration 0.1.2 → 0.1.3 (cascade) _CHANGELOG.md

• Version bump via cascade rule

@varlock/pass-plugin 1.0.2 → 1.0.3 _CHANGELOG.md

• Bundle this plugin's icon so generated types include it without a network request. The AWS, Azure, Google Cloud, Doppler, and Infisical icons are now monochrome so they follow the editor theme. (bump file)
• Fail instead of using partial output when a provider CLI is killed by a signal (bump file)

@varlock/passbolt-plugin 2.0.1 → 2.0.2 _CHANGELOG.md

• Bundle this plugin's icon so generated types include it without a network request. The AWS, Azure, Google Cloud, Doppler, and Infisical icons are now monochrome so they follow the editor theme. (bump file)

@varlock/proton-pass-plugin 2.0.1 → 2.0.2 _CHANGELOG.md

• Bundle this plugin's icon so generated types include it without a network request. The AWS, Azure, Google Cloud, Doppler, and Infisical icons are now monochrome so they follow the editor theme. (bump file)
• Fail instead of using partial output when a provider CLI is killed by a signal (bump file)

@varlock/vite-integration 1.5.2 → 1.5.3 _CHANGELOG.md

• Fix SvelteKit build warning about transformIndexHtml being unsupported (bump file)

env-spec-language 0.4.3 → 0.4.4 _CHANGELOG.md

• Add and() and or() resolver functions for combining boolean conditions (bump file)

[github-actions]

📦 Bundle size vs last published release

⚠️ grows the bundle by 382.6 KB (+8.2%)

Metric	v1.21.1 (published)	This release	Δ
Total dist	4639.6 KB	5022.2 KB	+382.6 KB (+8.2%)
JS	1753.1 KB	1901.7 KB	+148.6 KB (+8.5%)
Sourcemaps	2768.5 KB	2990.4 KB	+221.9 KB (+8.0%)
Type defs	118.0 KB	130.2 KB	+12.1 KB (+10.3%)
Other	0.0 KB	0.0 KB	—

dist/ only; native binaries are versioned separately and not counted here.