Repository navigation
Make strict url checks errors; default url protocols to http/https - #1222
Open
theoephraim wants to merge 1 commit into
Open
theoephraim wants to merge 1 commit into
theoephraim wants to merge 1 commit into
Conversation
theoephraim
added
the
BREAKING
github-actions
Bot
added
maintainer
core:website
core:varlock
core:vscode-plugin
labels
Contributor
|
The changes in this PR will be included in the next version bump.
|
Contributor
📦 Bundle size✅ shrinks the bundle by 2.9 KB (−0.1%)
dist/ only; native binaries are versioned separately and not counted here. |
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Important
varlock init still generates URL schemas that reject existing non-HTTP connection strings under the new defaults.
Reviewed changes: Reviewed the runtime URL validation, editor diagnostics, tests, and documentation for this breaking change.
- Strict validation: Structural URL checks now produce errors, and omitted
allowedProtocolspermits only HTTP and HTTPS. - HTTPS coercion:
prependHttpsnow prefixes any value without ascheme://prefix. - Editor diagnostics: Static validation enforces these rules as errors and removes the transitional warning path.
- Documentation and release scope: Reference documentation removes transition notes, the Action example explicitly allows PostgreSQL, and the change targets a major Varlock release.
gpt-6.1-sol ｜ 𝕏
| tip: `Only http and https are allowed unless set explicitly: add \`allowedProtocols=[${protocol}]\`, or \`allowedProtocols="*"\` to allow any.`, | ||
| }, | ||
| )); | ||
| errors.push(new ValidationError(`Protocol (${protocol}) is not allowed`, { |
Contributor
There was a problem hiding this comment.
[P2] Update schema inference alongside the new protocol default. varlock init still emits bare @type=url for _URL/_URI keys and URL-like values, so initializing a project with valid PostgreSQL or Redis connection strings now generates a schema that rejects those same values on load.
Technical details
# Generated schemas conflict with the new URL default
## Affected sites
- `packages/varlock/src/env-graph/lib/data-types.ts:527-531`: omitted `allowedProtocols` now produces an error for non-HTTP protocols.
- `packages/varlock/src/cli/helpers/infer-schema.ts:65-66,83-84`: both key-based and value-based inference emit bare `url`, without protocol options.
- `packages/varlock/src/cli/commands/init.command.ts:140-142,170-172`: initialization uses those inference helpers and writes the resulting schema.
## Reproduction
Passing the following parsed env file through `inferSchemaUpdates` produces bare `# @type=url` decorators on both items:
```dotenv
DATABASE_URL=postgres://localhost/db
REDIS_URL=redis://localhost:6379
```
Loading that generated schema with `EnvGraph` gives `error` for both items: `Protocol (postgres) is not allowed` and `Protocol (redis) is not allowed`. This was verified against the PR head; the existing 316 runtime data-type tests and 31 diagnostics-core tests pass but do not cover this path.
## Required outcome
- Schema inference should preserve valid known non-HTTP connection URLs under the new protocol default, for both existing example items and items inferred from other env files.
- Add regression coverage that infers a schema and loads its original connection values successfully.
## Suggested approach
- Emit explicit `allowedProtocols` for a non-HTTP protocol detected from a valid connection URL rather than weakening the new runtime default.Inference source: infer-schema.ts.
varlock
@varlock/astro-integration
@varlock/cloudflare-integration
@varlock/expo-integration
@varlock/nextjs-integration
@varlock/nuxt-integration
@varlock/vite-integration
@varlock/native-helper-darwin
@varlock/native-helper-linux-arm64
@varlock/native-helper-linux-x64
@varlock/native-helper-win32-x64
@varlock/1password-plugin
@varlock/akeyless-plugin
@varlock/aws-secrets-plugin
@varlock/aws-sigv4-plugin
@varlock/azure-key-vault-plugin
@varlock/bitwarden-plugin
@varlock/dashlane-plugin
@varlock/doppler-plugin
@varlock/effect-plugin
@varlock/google-secret-manager-plugin
@varlock/hashicorp-vault-plugin
@varlock/infisical-plugin
@varlock/keepass-plugin
@varlock/keeper-plugin
@varlock/kubernetes-plugin
@varlock/pass-plugin
@varlock/passbolt-plugin
@varlock/proton-pass-plugin
commit: |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
varlock-website | 5971606 | Commit Preview URL Branch Preview URL |
Oct 13 2026, 09:29 PM |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Breaking follow-up to #1220, which added these
urlchecks as warnings. This turns them into errors for the next major.scheme://.... Opaque values thatnew URL()accepts (SHA256:...fingerprints,user:pass,localhost:3000,mailto:,C:\path) are rejected.allowNoHost=true), and malformedhttp/https/ws/wss/ftphosts (backslashes, percent-encoded hosts, IPv4 shorthand, empty or hyphen-edged labels) are rejected.allowedProtocols, onlyhttpandhttpsare allowed. The error tip names the fix (allowedProtocols=[postgres], orallowedProtocols="*"for any).prependHttpsnow prefixes any value not starting withscheme://. Thehost:portdigit heuristic from Reject ambiguous url hosts under allowedDomains; prependHttps handles host:port #1218 is gone, since opaque URLs are no longer valid anyway.The VSCode extension reports these as errors (the separate warning path from #1220 is removed). Docs drop the "warning until the next major" notes, and the GitHub Action example's
DATABASE_URLsetsallowedProtocols.Not for merge until the major release.