🐸 Versioned release #1056

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

bumpy-bot wants to merge 1 commit into main from bumpy/version-packages

+77 −53

.bumpy/aws-sigv4-plugin.md

This file was deleted.

.bumpy/bun-compiled-cli-resolution.md

This file was deleted.

.bumpy/data-type-fixes.md

This file was deleted.

.bumpy/imported-current-env.md

This file was deleted.

.bumpy/leak-scan-finish-response.md

This file was deleted.

.bumpy/proxy-request-signing.md

This file was deleted.

.bumpy/short-sensitive-value-warning.md

This file was deleted.

bun.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

packages/env-spec-parser/CHANGELOG.md

-Original file line number
+Diff line change
@@ Expand Up / @@ -9,6 +9,13 @@ @@
+    ## 0.5.2
+    <sub>2026-09-04</sub>
+    - [#1064](https://github.com/dmno-dev/varlock/pull/1064)  *(patch)*
+      Data type fixes. `@type=enum` now matches numeric and boolean members against string values from `process.env` and `overrideValues`, so `LEVEL=2` or `FLAG=true` from CI satisfies `enum(1, 2, 3)` / `enum(true, false)`. `@type=url` matches `allowedDomains` in full against the URL host instead of as a substring, which previously let `example.com` pass an allowlist of `myexample.com`; write two or more hosts as an array (`allowedDomains=[a.com, b.com]`), since a comma inside a single string now errors and names the array to use. An `allowedDomains` entry without a port now allows any port, so `allowedDomains=[localhost]` accepts `http://localhost:3000`; add a port to pin it. Each entry must be a hostname with an optional port; an empty list, or a scheme, path, or credentials in an entry, now errors instead of silently matching the wrong host or nothing at all. VS Code diagnostics for `allowedDomains`, `allowedProtocols` and `noTrailingSlash` were reporting different results than an actual load, and now match. `@env-spec/parser` exports `autoCoerce` so tooling can classify unquoted values exactly as the parser does. `@type=url(noTrailingSlash=true)` now also catches a trailing slash that is followed by a query string or hash, such as `https://example.com/path/?q=1`. `@type=ip(version=6)` accepts IPv4-mapped addresses like `::ffff:192.168.1.1`. `@type=md5` accepts uppercase hex and normalizes it to lowercase. `@type=port` rejects non-integers such as `80.5`.
     ## 0.5.1
     <sub>2026-08-25</sub>
@@ Expand Down @@

packages/env-spec-parser/package.json

-Original file line number
+Diff line change
@@ -1,6 +1,6 @@
     {
       "name": "@env-spec/parser",
-      "version": "0.5.1",
+      "version": "0.5.2",
       "type": "module",
       "description": "Parser for @env-spec enabled dotenv files",
       "homepage": "https://varlock.dev",
@@ Expand Down @@

packages/native-helpers/darwin/CHANGELOG.md

-Original file line number
+Diff line change
@@ Expand Up / @@ -2,6 +2,12 @@ @@
+    ## 1.19.0
+    <sub>2026-09-04</sub>
+    - *(minor)* Version bump from group with `varlock` v1.19.0
     ## 1.18.0
     <sub>2026-09-01</sub>
@@ Expand Down @@

packages/native-helpers/darwin/package.json

-Original file line number
+Diff line change
@@ -1,6 +1,6 @@
     {
       "name": "@varlock/native-helper-darwin",
-      "version": "1.18.0",
+      "version": "1.19.0",
       "description": "varlock native helper binary for macOS (Secure Enclave local encryption). Installed automatically as an optional dependency of varlock.",
       "author": "dmno-dev",
       "license": "MIT",
@@ Expand Down @@

packages/native-helpers/linux-arm64/CHANGELOG.md

-Original file line number
+Diff line change
@@ Expand Up / @@ -2,6 +2,12 @@ @@
+    ## 1.19.0
+    <sub>2026-09-04</sub>
+    - *(minor)* Version bump from group with `varlock` v1.19.0
     ## 1.18.0
     <sub>2026-09-01</sub>
@@ Expand Down @@

packages/native-helpers/linux-arm64/package.json

-Original file line number
+Diff line change
@@ -1,6 +1,6 @@
     {
       "name": "@varlock/native-helper-linux-arm64",
-      "version": "1.18.0",
+      "version": "1.19.0",
       "description": "varlock native helper binary for Linux arm64 (TPM2/polkit local encryption). Installed automatically as an optional dependency of varlock.",
       "author": "dmno-dev",
       "license": "MIT",
@@ Expand Down @@

packages/native-helpers/linux-x64/CHANGELOG.md

-Original file line number
+Diff line change
@@ Expand Up / @@ -2,6 +2,12 @@ @@
+    ## 1.19.0
+    <sub>2026-09-04</sub>
+    - *(minor)* Version bump from group with `varlock` v1.19.0
     ## 1.18.0
     <sub>2026-09-01</sub>
@@ Expand Down @@

packages/native-helpers/linux-x64/package.json

-Original file line number
+Diff line change
@@ -1,6 +1,6 @@
     {
       "name": "@varlock/native-helper-linux-x64",
-      "version": "1.18.0",
+      "version": "1.19.0",
       "description": "varlock native helper binary for Linux x64 (TPM2/polkit local encryption). Installed automatically as an optional dependency of varlock.",
       "author": "dmno-dev",
       "license": "MIT",
@@ Expand Down @@

packages/native-helpers/win32-x64/CHANGELOG.md

-Original file line number
+Diff line change
@@ Expand Up / @@ -2,6 +2,12 @@ @@
+    ## 1.19.0
+    <sub>2026-09-04</sub>
+    - *(minor)* Version bump from group with `varlock` v1.19.0
     ## 1.18.0
     <sub>2026-09-01</sub>
@@ Expand Down @@

packages/native-helpers/win32-x64/package.json

-Original file line number
+Diff line change
@@ -1,6 +1,6 @@
     {
       "name": "@varlock/native-helper-win32-x64",
-      "version": "1.18.0",
+      "version": "1.19.0",
       "description": "varlock native helper binary for Windows x64 (TPM/DPAPI + Windows Hello local encryption). Also installs on Linux so WSL can use the Windows helper via interop. Installed automatically as an optional dependency of varlock.",
       "author": "dmno-dev",
       "license": "MIT",
@@ Expand Down @@

packages/plugins/aws-sigv4/CHANGELOG.md

-Original file line number
+Diff line change
@@ -0,0 +1,7 @@
+    # Changelog
+    ## 0.1.0
+    <sub>2026-09-04</sub>
+    - [#1008](https://github.com/dmno-dev/varlock/pull/1008)  *(minor)*
+      Initial release: adds the aws-sigv4 request-signing scheme to the credential proxy. The agent's AWS SDK signs with placeholder credentials; the proxy re-signs with the real keys, deriving region/service from the request, with optional region/service allowlists.

packages/plugins/aws-sigv4/package.json

-Original file line number
+Diff line change
@@ -1,7 +1,7 @@
     {
       "name": "@varlock/aws-sigv4-plugin",
       "description": "Varlock plugin adding AWS SigV4 request re-signing to the credential proxy (the agent signs with placeholder credentials; the proxy re-signs with the real keys)",
-      "version": "0.0.0",
+      "version": "0.1.0",
       "type": "module",
       "homepage": "https://varlock.dev/plugins/aws-sigv4/",
       "bugs": "https://github.com/dmno-dev/varlock/issues",
@@ Expand Down @@

packages/varlock/CHANGELOG.md

-Original file line number
+Diff line change
@@ Expand Up / @@ -27,6 +27,22 @@ @@
+    ## 1.19.0
+    <sub>2026-09-04</sub>
+    - [#1054](https://github.com/dmno-dev/varlock/pull/1054)  *(minor)*
+      Check that a value marked sensitive can actually be protected by redaction, which replaces it wherever it appears. Values under 12 characters warn. Values under 3 characters, booleans, numbers, composites with non-string elements, and the `@currentEnv` item are an error when you wrote `@sensitive` on the item, and a warning when `@defaultSensitive` swept it in, so nothing inherited from the default can fail a load. For a number, make it a string to keep leading zeros and precision. Composite values are checked per element, since redaction registers each element on its own. A non-sensitive value that contains a sensitive one now warns. Acknowledge a legitimately short secret with `@sensitive={allowShortValue=true}`; it does not apply under 3 characters. Also fixes sensitive values that are not strings, and the pre-coercion form of a coerced value, being shown unredacted in CLI output.
+    - [#1008](https://github.com/dmno-dev/varlock/pull/1008)  *(minor)*
+      Credential proxy: added request transforms, which let the proxy compute a request's credential itself rather than substituting a placeholder. HMAC signing and Basic auth are built in, and plugins can contribute new transformations.
+    - [#1060](https://github.com/dmno-dev/varlock/pull/1060)  *(patch)* - Find the Varlock CLI next to Bun-compiled workspace executables.
+    - [#1064](https://github.com/dmno-dev/varlock/pull/1064)  *(patch)*
+      Data type fixes. `@type=enum` now matches numeric and boolean members against string values from `process.env` and `overrideValues`, so `LEVEL=2` or `FLAG=true` from CI satisfies `enum(1, 2, 3)` / `enum(true, false)`. `@type=url` matches `allowedDomains` in full against the URL host instead of as a substring, which previously let `example.com` pass an allowlist of `myexample.com`; write two or more hosts as an array (`allowedDomains=[a.com, b.com]`), since a comma inside a single string now errors and names the array to use. An `allowedDomains` entry without a port now allows any port, so `allowedDomains=[localhost]` accepts `http://localhost:3000`; add a port to pin it. Each entry must be a hostname with an optional port; an empty list, or a scheme, path, or credentials in an entry, now errors instead of silently matching the wrong host or nothing at all. VS Code diagnostics for `allowedDomains`, `allowedProtocols` and `noTrailingSlash` were reporting different results than an actual load, and now match. `@env-spec/parser` exports `autoCoerce` so tooling can classify unquoted values exactly as the parser does. `@type=url(noTrailingSlash=true)` now also catches a trailing slash that is followed by a query string or hash, such as `https://example.com/path/?q=1`. `@type=ip(version=6)` accepts IPv4-mapped addresses like `::ffff:192.168.1.1`. `@type=md5` accepts uppercase hex and normalizes it to lowercase. `@type=port` rejects non-integers such as `80.5`.
+    - [#1065](https://github.com/dmno-dev/varlock/pull/1065)  *(patch)*
+      A leak detected in `ServerResponse.end` no longer leaves the HTTP client hanging. The response is finished before the leak error is rethrown (a plaintext 500 if the headers have not gone out yet, otherwise the connection is closed), so a Next.js Pages Router `res.json()` that would have leaked a sensitive value fails the request instead of stalling the client on a body that never arrives.
+    - [#1066](https://github.com/dmno-dev/varlock/pull/1066)  *(patch)*
+      `@currentEnv=$FLAG` can now reference a key brought in by `@import`, including a partial import that lists the flag in `pick=[...]`. Previously the flag had to be defined in the same file, which broke monorepo schemas that import a shared `DEPLOY_ENV`. A missing flag still errors, now naming the import as a way to provide it. An auto-loaded `.env` value on its own does not satisfy the flag or trigger `.env.<env>` loading. A `@currentEnv` declared in an imported file now also carries through a partial import when the flag is included in the filter. Directory imports declared before the import that provides the flag are rejected with an error asking you to reorder.
     ## 1.18.0
     <sub>2026-09-01</sub>
@@ Expand Down @@

packages/varlock/package.json

-Original file line number
+Diff line change
@@ -1,6 +1,6 @@
     {
       "name": "varlock",
-      "version": "1.18.0",
+      "version": "1.19.0",
       "description": "AI-safe .env files: Schemas for agents, Secrets for humans.",
       "main": "./dist/index.mjs",
       "types": "./dist/index.d.mts",
@@ Expand Down @@

packages/vscode-plugin/CHANGELOG.md

-Original file line number
+Diff line change
@@ Expand Up / @@ -13,6 +13,13 @@ @@
+    ## 0.4.1
+    <sub>2026-09-04</sub>
+    - [#1064](https://github.com/dmno-dev/varlock/pull/1064)  *(patch)*
+      Data type fixes. `@type=enum` now matches numeric and boolean members against string values from `process.env` and `overrideValues`, so `LEVEL=2` or `FLAG=true` from CI satisfies `enum(1, 2, 3)` / `enum(true, false)`. `@type=url` matches `allowedDomains` in full against the URL host instead of as a substring, which previously let `example.com` pass an allowlist of `myexample.com`; write two or more hosts as an array (`allowedDomains=[a.com, b.com]`), since a comma inside a single string now errors and names the array to use. An `allowedDomains` entry without a port now allows any port, so `allowedDomains=[localhost]` accepts `http://localhost:3000`; add a port to pin it. Each entry must be a hostname with an optional port; an empty list, or a scheme, path, or credentials in an entry, now errors instead of silently matching the wrong host or nothing at all. VS Code diagnostics for `allowedDomains`, `allowedProtocols` and `noTrailingSlash` were reporting different results than an actual load, and now match. `@env-spec/parser` exports `autoCoerce` so tooling can classify unquoted values exactly as the parser does. `@type=url(noTrailingSlash=true)` now also catches a trailing slash that is followed by a query string or hash, such as `https://example.com/path/?q=1`. `@type=ip(version=6)` accepts IPv4-mapped addresses like `::ffff:192.168.1.1`. `@type=md5` accepts uppercase hex and normalizes it to lowercase. `@type=port` rejects non-integers such as `80.5`.
     ## 0.4.0
     <sub>2026-09-01</sub>
@@ Expand Down @@

packages/vscode-plugin/package.json

-Original file line number
+Diff line change
@@ Expand Up / @@ -7,7 +7,7 @@ @@
         "color": "#4F0049",
         "theme": "dark"
       },
-      "version": "0.4.0",
+      "version": "0.4.1",
       "publisher": "varlock",
       "author": "dmno-dev",
       "license": "MIT",
@@ Expand Down @@

Navigation Menu

Uh oh!

🐸 Versioned release #1056

Diff view

Diff view

There are no files selected for viewing

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

🐸 Versioned release #1056

Are you sure you want to change the base?

🐸 Versioned release #1056

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!