🐸 Versioned release

[bumpy-bot]

This PR was created and will be kept in sync by bumpy based on your bump files (in .bumpy/). Merge it when you are ready to release the packages listed below:

Minor releases

@varlock/aws-sigv4-plugin 0.0.0 → 0.1.0 _CHANGELOG.md

• Initial release: adds the aws-sigv4 request-signing scheme to the credential proxy. The agent's AWS SDK signs with placeholder credentials; the proxy re-signs with the real keys, deriving region/service from the request, with optional region/service allowlists. (bump file)

@varlock/native-helper-darwin 1.18.0 → 1.19.0 _CHANGELOG.md

@varlock/native-helper-linux-arm64 1.18.0 → 1.19.0 _CHANGELOG.md

@varlock/native-helper-linux-x64 1.18.0 → 1.19.0 _CHANGELOG.md

@varlock/native-helper-win32-x64 1.18.0 → 1.19.0 _CHANGELOG.md

varlock 1.18.0 → 1.19.0 _CHANGELOG.md

• Check that a value marked sensitive can actually be protected by redaction, which replaces it wherever it appears. Values under 12 characters warn. Values under 3 characters, booleans, numbers, composites with non-string elements, and the @currentEnv item are an error when you wrote @sensitive on the item, and a warning when @defaultSensitive swept it in, so nothing inherited from the default can fail a load. For a number, make it a string to keep leading zeros and precision. Composite values are checked per element, since redaction registers each element on its own. A non-sensitive value that contains a sensitive one now warns. Acknowledge a legitimately short secret with @sensitive={allowShortValue=true}; it does not apply under 3 characters. Also fixes sensitive values that are not strings, and the pre-coercion form of a coerced value, being shown unredacted in CLI output. (bump file)
• Credential proxy: added request transforms, which let the proxy compute a request's credential itself rather than substituting a placeholder. HMAC signing and Basic auth are built in, and plugins can contribute new transformations. (bump file)
• Find the Varlock CLI next to Bun-compiled workspace executables. (bump file)
• Data type fixes. @type=enum now matches numeric and boolean members against string values from process.env and overrideValues, so LEVEL=2 or FLAG=true from CI satisfies enum(1, 2, 3) / enum(true, false). @type=url matches allowedDomains in full against the URL host instead of as a substring, which previously let example.com pass an allowlist of myexample.com; write two or more hosts as an array (allowedDomains=[a.com, b.com]), since a comma inside a single string now errors and names the array to use. An allowedDomains entry without a port now allows any port, so allowedDomains=[localhost] accepts http://localhost:3000; add a port to pin it. Each entry must be a hostname with an optional port; an empty list, or a scheme, path, or credentials in an entry, now errors instead of silently matching the wrong host or nothing at all. VS Code diagnostics for allowedDomains, allowedProtocols and noTrailingSlash were reporting different results than an actual load, and now match. @env-spec/parser exports autoCoerce so tooling can classify unquoted values exactly as the parser does. @type=url(noTrailingSlash=true) now also catches a trailing slash that is followed by a query string or hash, such as https://example.com/path/?q=1. @type=ip(version=6) accepts IPv4-mapped addresses like ::ffff:192.168.1.1. @type=md5 accepts uppercase hex and normalizes it to lowercase. @type=port rejects non-integers such as 80.5. (bump file)
• A leak detected in ServerResponse.end no longer leaves the HTTP client hanging. The response is finished before the leak error is rethrown (a plaintext 500 if the headers have not gone out yet, otherwise the connection is closed), so a Next.js Pages Router res.json() that would have leaked a sensitive value fails the request instead of stalling the client on a body that never arrives. (bump file)
• @currentEnv=$FLAG can now reference a key brought in by @import, including a partial import that lists the flag in pick=[...]. Previously the flag had to be defined in the same file, which broke monorepo schemas that import a shared DEPLOY_ENV. A missing flag still errors, now naming the import as a way to provide it. An auto-loaded .env value on its own does not satisfy the flag or trigger .env.<env> loading. A @currentEnv declared in an imported file now also carries through a partial import when the flag is included in the filter. Directory imports declared before the import that provides the flag are rejected with an error asking you to reorder. (bump file)

Patch releases

@env-spec/parser 0.5.1 → 0.5.2 _CHANGELOG.md

• Data type fixes. @type=enum now matches numeric and boolean members against string values from process.env and overrideValues, so LEVEL=2 or FLAG=true from CI satisfies enum(1, 2, 3) / enum(true, false). @type=url matches allowedDomains in full against the URL host instead of as a substring, which previously let example.com pass an allowlist of myexample.com; write two or more hosts as an array (allowedDomains=[a.com, b.com]), since a comma inside a single string now errors and names the array to use. An allowedDomains entry without a port now allows any port, so allowedDomains=[localhost] accepts http://localhost:3000; add a port to pin it. Each entry must be a hostname with an optional port; an empty list, or a scheme, path, or credentials in an entry, now errors instead of silently matching the wrong host or nothing at all. VS Code diagnostics for allowedDomains, allowedProtocols and noTrailingSlash were reporting different results than an actual load, and now match. @env-spec/parser exports autoCoerce so tooling can classify unquoted values exactly as the parser does. @type=url(noTrailingSlash=true) now also catches a trailing slash that is followed by a query string or hash, such as https://example.com/path/?q=1. @type=ip(version=6) accepts IPv4-mapped addresses like ::ffff:192.168.1.1. @type=md5 accepts uppercase hex and normalizes it to lowercase. @type=port rejects non-integers such as 80.5. (bump file)

env-spec-language 0.4.0 → 0.4.1 _CHANGELOG.md

• Data type fixes. @type=enum now matches numeric and boolean members against string values from process.env and overrideValues, so LEVEL=2 or FLAG=true from CI satisfies enum(1, 2, 3) / enum(true, false). @type=url matches allowedDomains in full against the URL host instead of as a substring, which previously let example.com pass an allowlist of myexample.com; write two or more hosts as an array (allowedDomains=[a.com, b.com]), since a comma inside a single string now errors and names the array to use. An allowedDomains entry without a port now allows any port, so allowedDomains=[localhost] accepts http://localhost:3000; add a port to pin it. Each entry must be a hostname with an optional port; an empty list, or a scheme, path, or credentials in an entry, now errors instead of silently matching the wrong host or nothing at all. VS Code diagnostics for allowedDomains, allowedProtocols and noTrailingSlash were reporting different results than an actual load, and now match. @env-spec/parser exports autoCoerce so tooling can classify unquoted values exactly as the parser does. @type=url(noTrailingSlash=true) now also catches a trailing slash that is followed by a query string or hash, such as https://example.com/path/?q=1. @type=ip(version=6) accepts IPv4-mapped addresses like ::ffff:192.168.1.1. @type=md5 accepts uppercase hex and normalizes it to lowercase. @type=port rejects non-integers such as 80.5. (bump file)

[github-actions]

📦 Bundle size vs last published release

⚠️ grows the bundle by 186.9 KB (+4.4%)

Metric	v1.18.0 (published)	This release	Δ
Total dist	4292.2 KB	4479.1 KB	+186.9 KB (+4.4%)
JS	1645.6 KB	1702.2 KB	+56.6 KB (+3.4%)
Sourcemaps	2549.8 KB	2667.5 KB	+117.8 KB (+4.6%)
Type defs	96.8 KB	109.3 KB	+12.5 KB (+12.9%)
Other	0.0 KB	0.0 KB	—

dist/ only; native binaries are versioned separately and not counted here.