[bumpy-bot]

This PR was created and will be kept in sync by bumpy based on your bump files (in .bumpy/). Merge it when you are ready to release the packages listed below:

Major releases

@varlock/nextjs-integration 1.2.5 → 2.0.0 _CHANGELOG.md

• Fix env file watchers keeping short-lived processes (such as Next's telemetry helper after next dev stops) running forever (bump file)
• Builds no longer bake the resolved env into their output unless they freeze it, controlled by the new freezeIntoBundle option ('auto' by default: freeze on Vercel, Netlify, Cloudflare Workers Builds, AWS Amplify and OpenNext; resolve at boot elsewhere). What to check when upgrading: (bump file)
  • output: 'standalone' (e.g. Docker images): the build now fails until you set freezeIntoBundle: true (bake the env, encrypted; the server needs only _VARLOCK_ENV_KEY) or false (the server resolves at boot, so the varlock CLI must be available, e.g. varlock run -- node server.js). Previously a standalone server with no CLI silently booted from build-time values.
  • Frozen builds must be encrypted: set _VARLOCK_ENV_KEY at build and runtime (generate one with varlock generate-key), or opt out with _VARLOCK_ALLOW_PLAINTEXT_FROZEN_ENV=1.
  • next start without the varlock CLI fails at boot with the fixes instead of falling back to build-time values.
    A frozen env wins over the environment at boot (with a warning when they differ), and @dynamic=boot keys can be set per instance.
• New varlock/auto-init entry: a single edge-safe import that initializes the runtime from an already-resolved env (decrypting it if needed) and applies all runtime patches, without calling the CLI. The same sequence is available as a function, initVarlockRuntime() from varlock/init, for code that has to set up its inputs first. The Next.js integration now injects one varlock/init-bundle file into both server and edge runtimes (varlock/init-server and varlock/init-edge remain as aliases of it). varlock/patch-server-response now loads node builtins lazily and is a no-op where node:http does not exist, so the same init code runs in Node, Bun, Cloudflare Workers and Vercel Edge. The vite, Cloudflare and Astro integrations use it instead of assembling the init sequence module by module; the vite plugin's ssrEdgeRuntime option is no longer needed and is ignored. (bump file)

Minor releases

@varlock/native-helper-darwin 1.23.0 → 1.24.0 _CHANGELOG.md

@varlock/native-helper-linux-arm64 1.23.0 → 1.24.0 _CHANGELOG.md

@varlock/native-helper-linux-x64 1.23.0 → 1.24.0 _CHANGELOG.md

@varlock/native-helper-win32-x64 1.23.0 → 1.24.0 _CHANGELOG.md

varlock 1.23.0 → 1.24.0 _CHANGELOG.md

• Release cache locks when interrupted right after acquiring them, instead of leaving an orphaned lock (bump file)
• macOS standalone binaries are now Developer ID signed and notarized, with hardened runtime enabled (bump file)
• Add varlock load --defer-boot-required and the varlock/frozen-env-boot runtime bundle, used by framework integrations that freeze the env into their build output. A frozen env now warns once at boot when the environment sets a different value for one of its keys. Fix decrypting an encrypted env in Next.js's local edge runtime, and a re-init reverting __VARLOCK_ENV to the value it had at process start. (bump file)
• proxy run --url now sets NODE_USE_ENV_PROXY=1 in the child, so Node's built-in fetch routes through a remote broker like it does locally. (bump file)
• Name the failing keys on the last line of output when config is invalid, so tools that only show the tail of a failed process (e.g. Kubernetes termination messages) say which vars to fix. CLI error summaries are now prefixed with [varlock] (bump file)
• Put /* eslint-disable */ above // @ts-nocheck in generated TypeScript types, so ESLint rules about @ts-nocheck no longer report the generated file (bump file)
• New varlock/auto-init entry: a single edge-safe import that initializes the runtime from an already-resolved env (decrypting it if needed) and applies all runtime patches, without calling the CLI. The same sequence is available as a function, initVarlockRuntime() from varlock/init, for code that has to set up its inputs first. The Next.js integration now injects one varlock/init-bundle file into both server and edge runtimes (varlock/init-server and varlock/init-edge remain as aliases of it). varlock/patch-server-response now loads node builtins lazily and is a no-op where node:http does not exist, so the same init code runs in Node, Bun, Cloudflare Workers and Vercel Edge. The vite, Cloudflare and Astro integrations use it instead of assembling the init sequence module by module; the vite plugin's ssrEdgeRuntime option is no longer needed and is ignored. (bump file)

Patch releases

@varlock/1password-plugin 2.0.5 → 2.0.6 _CHANGELOG.md

• Read 1Password Environments with stable op releases (v2.41.0+) via op run --environment. Older beta CLIs that only had op environment read need to update with op update (bump file)

@varlock/astro-integration 1.4.4 → 1.4.5 _CHANGELOG.md

• New varlock/auto-init entry: a single edge-safe import that initializes the runtime from an already-resolved env (decrypting it if needed) and applies all runtime patches, without calling the CLI. The same sequence is available as a function, initVarlockRuntime() from varlock/init, for code that has to set up its inputs first. The Next.js integration now injects one varlock/init-bundle file into both server and edge runtimes (varlock/init-server and varlock/init-edge remain as aliases of it). varlock/patch-server-response now loads node builtins lazily and is a no-op where node:http does not exist, so the same init code runs in Node, Bun, Cloudflare Workers and Vercel Edge. The vite, Cloudflare and Astro integrations use it instead of assembling the init sequence module by module; the vite plugin's ssrEdgeRuntime option is no longer needed and is ignored. (bump file)

@varlock/cloudflare-integration 1.6.2 → 1.6.3 _CHANGELOG.md

• Fail with a clear message when a built Worker has no __VARLOCK_ENV binding (e.g. run with plain wrangler dev or deployed with plain wrangler deploy), pointing at varlock-wrangler dev / deploy instead of the generic initVarlockEnv advice (bump file)
• New varlock/auto-init entry: a single edge-safe import that initializes the runtime from an already-resolved env (decrypting it if needed) and applies all runtime patches, without calling the CLI. The same sequence is available as a function, initVarlockRuntime() from varlock/init, for code that has to set up its inputs first. The Next.js integration now injects one varlock/init-bundle file into both server and edge runtimes (varlock/init-server and varlock/init-edge remain as aliases of it). varlock/patch-server-response now loads node builtins lazily and is a no-op where node:http does not exist, so the same init code runs in Node, Bun, Cloudflare Workers and Vercel Edge. The vite, Cloudflare and Astro integrations use it instead of assembling the init sequence module by module; the vite plugin's ssrEdgeRuntime option is no longer needed and is ignored. (bump file)

@varlock/nuxt-integration 0.1.4 → 0.1.5 (cascade) _CHANGELOG.md

• Version bump via cascade rule

@varlock/vite-integration 1.5.4 → 1.5.5 _CHANGELOG.md

• Keep secrets logged in React Server Components out of the dev-mode RSC payload: React's dev console replay now gets redacted args, so logging a sensitive value no longer trips leak detection and truncates the page (bump file)
• Detect @sveltejs/adapter-cloudflare with SvelteKit 3, which moved the resolved adapter out of kit, so the Workers env loader is injected without explicit options (bump file)
• New varlock/auto-init entry: a single edge-safe import that initializes the runtime from an already-resolved env (decrypting it if needed) and applies all runtime patches, without calling the CLI. The same sequence is available as a function, initVarlockRuntime() from varlock/init, for code that has to set up its inputs first. The Next.js integration now injects one varlock/init-bundle file into both server and edge runtimes (varlock/init-server and varlock/init-edge remain as aliases of it). varlock/patch-server-response now loads node builtins lazily and is a no-op where node:http does not exist, so the same init code runs in Node, Bun, Cloudflare Workers and Vercel Edge. The vite, Cloudflare and Astro integrations use it instead of assembling the init sequence module by module; the vite plugin's ssrEdgeRuntime option is no longer needed and is ignored. (bump file)

[github-actions]

📦 Bundle size vs last published release

⚠️ grows the bundle by 95.5 KB (+1.9%)

Metric	v1.23.0 (published)	This release	Δ
Total dist	5077.5 KB	5173.1 KB	+95.5 KB (+1.9%)
JS	1921.5 KB	1975.4 KB	+54.0 KB (+2.8%)
Sourcemaps	3025.4 KB	3060.5 KB	+35.1 KB (+1.2%)
Type defs	130.7 KB	137.1 KB	+6.4 KB (+4.9%)
Other	0.0 KB	0.0 KB	—

dist/ only; native binaries are versioned separately and not counted here.