[bumpy-bot]

This PR was created and will be kept in sync by bumpy based on your bump files (in .bumpy/). Merge it when you are ready to release the packages listed below:

Minor releases

@varlock/native-helper-darwin 1.22.0 → 1.23.0 _CHANGELOG.md

@varlock/native-helper-linux-arm64 1.22.0 → 1.23.0 _CHANGELOG.md

@varlock/native-helper-linux-x64 1.22.0 → 1.23.0 _CHANGELOG.md

@varlock/native-helper-win32-x64 1.22.0 → 1.23.0 _CHANGELOG.md

env-spec-language 0.4.4 → 0.5.0 _CHANGELOG.md

• url(allowedDomains=...) now rejects values whose host other URL parsers could read differently (backslashes, whitespace, percent-encoded or non-ASCII hosts, IPv4 shorthand, missing scheme://host), which could let a value pass the allowlist while the app connects elsewhere. Write internationalized hosts in punycode. url(prependHttps=true) now prefixes host:port values like localhost:3000. (bump file)
• The url type now warns on values that only parse because new URL() is permissive: anything not written as scheme://... (like an SSH key fingerprint SHA256:... or user:pass), whitespace or control characters, a missing host, and malformed http/https hosts the parser would otherwise rewrite (https:///example.com, http://0x7f.1, https://a..b). It also warns on protocols other than http/https when allowedProtocols is not set. These become errors in the next major version. New options: allowedProtocols="*" allows any protocol, and allowNoHost=true allows host-less URLs like sqlite:///app.db. (bump file)

varlock 1.22.0 → 1.23.0 _CHANGELOG.md

• url(allowedDomains=...) now rejects values whose host other URL parsers could read differently (backslashes, whitespace, percent-encoded or non-ASCII hosts, IPv4 shorthand, missing scheme://host), which could let a value pass the allowlist while the app connects elsewhere. Write internationalized hosts in punycode. url(prependHttps=true) now prefixes host:port values like localhost:3000. (bump file)
• Python codegen: @generatePythonEnv now emits a lazily loaded ENV object with a documented property per item, so editors show item descriptions, @docs() links and deprecations on hover where values are read. Env TypedDict fields get docstrings instead of # comments. (bump file)
• The url type now warns on values that only parse because new URL() is permissive: anything not written as scheme://... (like an SSH key fingerprint SHA256:... or user:pass), whitespace or control characters, a missing host, and malformed http/https hosts the parser would otherwise rewrite (https:///example.com, http://0x7f.1, https://a..b). It also warns on protocols other than http/https when allowedProtocols is not set. These become errors in the next major version. New options: allowedProtocols="*" allows any protocol, and allowNoHost=true allows host-less URLs like sqlite:///app.db. (bump file)
• Telemetry no longer adds latency to CLI commands. Events still in flight when a command finishes are handed to a detached background process instead of being awaited, so varlock load and varlock/auto-load take the same time with telemetry on or off. The background process runs from the system temp directory, so it never keeps the project directory in use. (bump file)
• Commented-out config items (ex: # API_KEY=prod-value, including multi-line values) are no longer treated as part of the next item's description, so their values no longer leak into generated types or other description output. (bump file)
• Report auto-load CLI crashes with their command and original status, and exit with code 1 instead of a native crash code. (bump file)

Patch releases

@env-spec/parser 0.6.1 → 0.6.2 _CHANGELOG.md

• Commented-out config items (ex: # API_KEY=prod-value, including multi-line values) are no longer treated as part of the next item's description, so their values no longer leak into generated types or other description output. (bump file)

@varlock/astro-integration 1.4.3 → 1.4.4 (cascade) _CHANGELOG.md

• Version bump via cascade rule

@varlock/cloudflare-integration 1.6.1 → 1.6.2 _CHANGELOG.md

• @varlock/cloudflare-integration/init no longer breaks prerendering on frameworks that run the server bundle in Node (such as Nuxt 5 / Nitro 3 with the cloudflare_module preset). When cloudflare:workers can't be loaded, it reads the same keys from process.env. The SSR entry loader used by the Vite, Astro, and SvelteKit integrations no longer skips loading bindings in Workers that set no_global_navigator. (bump file)
• Report a crashed varlock CLI with its command and original exit status instead of failing silently. Next.js builds exit with code 1 instead of a native crash code. (bump file)

@varlock/expo-integration 1.2.1 → 1.2.2 _CHANGELOG.md

• Report a crashed varlock CLI with its command and original exit status instead of failing silently. Next.js builds exit with code 1 instead of a native crash code. (bump file)

@varlock/nextjs-integration 1.2.4 → 1.2.5 _CHANGELOG.md

• Report a crashed varlock CLI with its command and original exit status instead of failing silently. Next.js builds exit with code 1 instead of a native crash code. (bump file)

@varlock/nuxt-integration 0.1.3 → 0.1.4 (cascade) _CHANGELOG.md

• Version bump via cascade rule

@varlock/vite-integration 1.5.3 → 1.5.4 _CHANGELOG.md

• Report a crashed varlock CLI with its command and original exit status instead of failing silently. Next.js builds exit with code 1 instead of a native crash code. (bump file)

[github-actions]

📦 Bundle size vs last published release

⚠️ grows the bundle by 55.3 KB (+1.1%)

Metric	v1.22.0 (published)	This release	Δ
Total dist	5022.2 KB	5077.5 KB	+55.3 KB (+1.1%)
JS	1901.7 KB	1921.5 KB	+19.8 KB (+1.0%)
Sourcemaps	2990.4 KB	3025.4 KB	+35.0 KB (+1.2%)
Type defs	130.2 KB	130.7 KB	+0.5 KB (+0.4%)
Other	0.0 KB	0.0 KB	—

dist/ only; native binaries are versioned separately and not counted here.